问号在 MySQL 中“WHERE column = ?"的意义是什么?

2021-11-20 00:00:00 syntax mysql

我正在剖析一些代码并遇到了这个，

I am dissecting some code and came across this, 

$sql = 'SELECT page.*, author.name AS author, updator.name AS updator '
     . 'FROM '.TABLE_PREFIX.'page AS page '
     . 'LEFT JOIN '.TABLE_PREFIX.'user AS author ON author.id = page.created_by_id '
     . 'LEFT JOIN '.TABLE_PREFIX.'user AS updator ON updator.id = page.updated_by_id '
     . 'WHERE slug = ? AND parent_id = ? AND (status_id='.Page::STATUS_REVIEWED.' OR status_id='.Page::STATUS_PUBLISHED.' OR status_id='.Page::STATUS_HIDDEN.')';

我想知道什么是?"在 WHERE 语句中.它是某种参数持有者吗?

I am wondering what the "?" does in the WHERE statement. Is it some sort of parameter holder?

推荐答案

准备好的语句使用?"在 MySQL 中允许将参数绑定到语句.如果使用得当，被高度认为可以更安全地防止 SQL 注入.这也允许更快的 SQL 查询，因为请求只需编译一次并且可以重复使用.

Prepared statments use the '?' in MySQL to allow for binding params to the statement. Highly regarded as more secure against SQL injections if used properly. This also allows for quicker SQL queries as the request only has to be compiled once and can be reused.

相关文章