1. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Topics covered Structured Query Language What can it do? Advantages of SQL Why bother with SQL? The restaurant model Example SQL usage in PHP

2. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL What can it do? SQL provides commands for a variety of tasks including: querying data, inserting, updating, and deleting rows in a table, creating, replacing, altering, and dropping objects, controlling access to the database and its objects, guaranteeing database consistency and integrity.

3. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Advantages of SQL All major relational database management systems support SQL You can transfer all skills you have gained with SQL from one database to another SQL lets you work with data at the logical level, only being concerned with the implementation details when you want to manipulate them. i.e. you do not need to know how or where data is stored

4. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Why bother with SQL? SQL gives us the power to access the contents of a database in a simple, powerful way SQL is (mostly) independent of the underlying database engine So you can use SQL with many different kinds of database This is simpler than learning how to access each type of database in a proprietary way

5. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The restaurant model The query engine provides a layer between programming languages and database. It allows a developer to write programs which access data, without knowing how the database is implemented.

6. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL // grabs matching record(s) from the “tblstudent" table $sSQL="SELECT * FROM tblstudent WHERE Email='$sEmail' "; $rsMain = $ mysqli->query ($sSQL); // grabs matching record(s) from the “tblstudent" table $sSQL="SELECT * FROM tblstudent WHERE Email='$sEmail' "; $rsMain = $ mysqli->query ($sSQL); Example SQL usage in PHP What does the SQL do? How does PHP use SQL? How does the SQL get sent to the database? Where do the results of the query appear?

7. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL $sSQL = "SELECT * FROM student WHERE Email='$sEmail' "; $sSQL = "SELECT * FROM student WHERE Email='ab123456' "; SQL to English conversion Select each record from the table called “tblstudent” where the value of the “Email” field in the record being checked is equal to the value held in the PHP variable “$sEmail”. i.e. grab all the stuff where there’s a match!

8. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Useful SQL SELECT examples SELECT lastname, age FROM tblstudent WHERE firstname=‘Naomi’; SELECT * FROM tblstudent WHERE firstname LIKE ‘Naom*’; SELECT * FROM tblstudent WHERE age BETWEEN 16 AND 25; SELECT firstname, studentnumber FROM tblstudent WHERE age>=25; SELECT * FROM tblstudent WHERE studentnumber IS NOT NULL;

9. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL More SQL SELECT examples SELECT * FROM tblstudent ORDER BY age DESC; SELECT * FROM tblstudent WHERE postcode IN(‘ST1’, ‘ST4’, ‘ST6’); SELECT * FROM tblstudent WHERE age BETWEEN 16 AND 25 ORDER BY age, studentnumber DESC; SELECT firstname, studentnumber FROM tblstudent WHERE age>=55 AND studentnumber IS NOT NULL; SELECT COUNT(*) AS “Total” FROM tblstudent WHERE age>=55;

10. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The Four SQL Statements There are four main SQL statements you will use. The most useful is SELECT, which we have just seen. It is usually used in this format; SELECT column_name(s) FROM table_name SELECT column_name(s) FROM table WHERE column operator value e.g. SELECT lastname, age FROM emp WHERE firstname=‘Naomi’;

11. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The Insert Statement INSERT INTO table_name VALUES (value1, value2,....) Inserts a new row into an existing table INSERT INTO Persons VALUES (‘Lightman', ‘David‘, ‘dlightman@gtnw.org’); INSERT INTO Authorisation VALUES (‘Joshua’, ‘BURGR’); Insert Data in Specified Columns INSERT INTO Persons (LastName, Address) VALUES (‘Smith', '7 Lee Avenue');

12. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The Update Statement UPDATE table_name SET column_name=new_value WHERE column_name=some_value; Update one Column in a Row: UPDATE Person SET FirstName='Bob' WHERE Email='ab123456'; Update several Columns in a Row: UPDATE Person SET Address='21 Jump Street', City='Los Angeles' WHERE LastName='Hanson';

13. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The Delete Statement DELETE FROM table_name WHERE column_name = some_value Delete one Row: DELETE FROM Person WHERE Email='ab123456'; Delete several Rows: DELETE FROM Person WHERE LastName='Smith'; Delete all Rows in a Table: [Beware!] DELETE FROM Person; → Same as: DELETE FROM Person WHERE LastName='*';

14. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL The Database Connection Creates a new connection, configured for student ID codes // Note: username is “xy123456”, password is “xy123456” // This is unusual – normally the user, pwd and dbname differ $id= 'xy123456'; $mysqli = new mysqli("web.fcet.staffs.ac.uk", $id, $id, $id); if ($mysqli->connect_errno) {die( "Failed to connect to MySQL: (". $mysqli->connect_errno. ") ". $mysqli->connect_error ); }

15. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Using the Statements - Select // Receives values from Form, assigns values entered to vars $npage_code = $_REQUEST['code']; $sSQL = "SELECT * FROM PageElements WHERE PageCode='$npage_code' "; $rsSearch = $mysqli->query($sSQL); // fetches a row of fields and steps to the next one $row = $rsSearch->fetch_assoc(); // gets each field by name $linkcode=$row['LinkAd']; $buycode=$row['BuyAd'];

16. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Using the Statements - Insert // Receives values from Form, assigns values entered to vars $formname = $_REQUEST["name"]; $formemail = $_REQUEST["email"]; $formcomments = $_REQUEST["comments"]; // Declares SQL statement that will add data to the database $sSQL = "INSERT INTO users (usrName, usrEmail, usrComments) VALUES ('$formname', '$formemail', '$formcomments')"; // Just runs the SQL query (but better if we checked for errors) $mysqli->query($sSQL); $mysqli->close();

17. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Using the Statements - Update // Declares SQL statement that will update a database $sSQL = "UPDATE Members SET FirstName='Mike' WHERE LastName='North' "; // Executes the SQL… $mysqli->query($sSQL); // note that SELECT, UPDATE, DELETE and INSERT SQL statements all work with the “query()” method

18. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Using the Statements - Delete // Declares SQL statement to delete from a DB $sSQL="DELETE FROM Members WHERE CITY='BELFAST' "; // Executes the SQL statement If( !$mysqli->query($sSQL) ) {die("Could not insert into table: ". $mysqli->error); }

19. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Prepared Statements Prepared statements use a template system to avoid SQL injection attacks. Example code below – look for the placeholder character $stmt = $mysqli->prepare("SELECT id FROM tblMsgHubUser WHERE tuName=?"); $stmt->bind_param("s", $sUser); // s=string $stmt->execute();

20. Nic Shulver, N.A.Shulver@staffs.ac.uk Introduction to SQL Conclusion We have seen What SQL can be used for, The value of SQL as a cross-platform database interface language, Many examples of SQL clauses, Examples of SQL in PHP. http://uk3.php.net/manual/en/class.mysqli.php