What is MySQLi? Since the mid-90s, Mysql extension has served as the major bridge between PHP and MySQL. Although it has performed its duty quite well, situation has changed since the introduction of PHP 5 and MySQL 4.1

What is MySQLi? To correct the issues of MySQL extension, a new extenstion has been created for PHP5 It is called MySQLi It supports all the latest features in MySQL server 4.1 or higher The ‘i’ stands for any one of: improved, interface, ingenious, incompatible or incomplete.

Major Features Procedural Interface An object-oriented interface Support for the new MySQL binary protocol that was introduced in MySQL 4.1. Support for the full feature set of the MySQL C client library

Why Make the Switch? Maintainable Similar Syntax New Interface Advanced Options Speed Security

Let’s see the code! /* Connect to a MySQL Server */ $mysqli = new mysqli('hostname','username','password','database'); if ( mysqli_connect_errno() ) { echo "Connection error. Errorcode: ".mysqli_connect_error(); exit; } /* Close the connection */ $mysqli->close();

How to Run a Query if ($result = $mysqli->query('SELECT Name, Population FROM City ORDER BY Population DESC LIMIT 5')) { /* Fetch the results of the query */ while( $row = $result->fetch_assoc() ){ echo $row['Name']." (". $row['Population'].")\n"; } /* Destroy the result set and free the memory used for it */ $result->close(); } else { echo $mysqli->error; }

Prepared Statements One of the new features of MySQLi Using this feature, it is possible to create queries that are: More secure Have better performance More convenient to write Two types of Prepared Statements: Bound Parameter Bound Result

Bound Parameter Prepared Statements A Query template is created and sent to the MySQL server MySQL server validates it, stores it and returns a special handle for future use When a query needs to be executed, data to fill in the template is sent to the server A complete query is formed and then executed

Advantages The body of the query is sent only once, later only data to fill in are sent Most of the work required to validate and parse the query only needs to be done a single time, instead of each time the query is executed. The data for the query does not need to be passed through a function like mysql_real_escape_string() to ensure that no SQL injection attacks occur. Instead, the sent data is handled safely by server when it is combined with the prepared statement.

Query Structure The '?' placeholders can be used in most places that could have literal data, e.g. a query could be transformed from SELECT Population FROM City WHERE Name = 'Dhaka'; to SELECT Population FROM City WHERE Name = ?; Let’s see a complete example of bound parameter prepared statement

Using Bound Parameter Prepared Statements if( $stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)") ){ $stmt->bind_param('sssd', $code, $language, $official, $percent); $code = 'BAN'; $language = 'Bangla'; $official = 'F'; $percent = 77.8; /* execute prepared statement */ $stmt->execute(); echo $stmt->affected_rows. " Row inserted.\n"; /* close statement and connection */ $stmt->close(); }

The Format String The following table shows the bound varaible types and when to use them: BIND TypeCOLUMN Type i All INT types dDOUBLE and FLOAT b BLOBs sAll other types

Bound Result Prepared Statements Allow the value of variables in a PHP script to be tied to the value of fields of data in a query result set. Create a query Prepare the query Ask the MySQL server to execute the query Bind PHP variables to columns in the query result Request that a new row of data be loaded into the bound variables.

Using Bound Result Prepared Statements if( $stmt = $mysqli->prepare("SELECT Code, Name FROM Country ORDER BY Name LIMIT 5") ){ $stmt->execute(); /* bind variables to prepared statement */ $stmt->bind_result($col1, $col2); /* fetch values */ while ($stmt->fetch()) { echo $col1." ". $col2."\n"; } /* close statement */ $stmt->close(); }

Using Bound Parameters and Bound Results Together It is possible to use bound parameters and bound results together in a single prepared statement. Lets see a more complete example that uses both of these

Using Bound Parameters and Bound Results Together if ( $stmt = $mysqli->prepare("SELECT Code, Name FROM Country WHERE Code LIKE ? LIMIT 5") ) { $stmt->bind_param("s", $code); $code = "B%"; $stmt->execute(); /* bind variables to prepared statement */ $stmt->bind_result($col1, $col2); /* fetch values */ while ($stmt->fetch()) { echo $col1." ". $col2."\n"; } /* close statement */ $stmt->close(); }

More Reference

THANK YOU