Server-Side Application and Data Management IT IS 3105 (FALL 2009) PHP and MySQL (Cont.) Mohamed Shehab Lecture 6

Setting up the Connection The PHP library for connecting to MySQL is called mysqli, where the i stands for improved. To connect to the MySQL server: $hostname = “localhost”; $username = “root”; $password = “123456”; $dbname = “mydb”; $db = new mysqli($hostname, $username, $password, $dbname); This line instantiate the mysqli class and creates a connection to the localhost and database with the specified username, and password.

Setting up the Connection The result of your attempt to connect is checked using the $db->connect_error value: $db = new mysqli($hostname, $username, $password, $dbname); if($db->connect_error){ echo ‘Error:’ . $db->connect_error; exit; }

Querying the Database Prepare a query string, then call the mysqli query method: $query = “select * from students”; $result = $db->query($query); In case of SELECT the query method returns a result set and false if there is an error. The result set can be accessed in multiple ways.

Querying the Database Accessing the result set: Method Description $result->fetch_assoc() Returns an associative array of strings representing the fetched row in the result set, where each key in the array represents the name of one of the result set's columns or NULL if there are no more rows in resultset. $result->fetch_row() Fetches one row of data from the result set and returns it as an enumerated array, where each column is stored in an array offset starting from 0 (zero). $result->fetch_object() Returns the current row result set as an object where the attributes of the object represent the names of the fields found within the result set.

$result->fetch_assoc() while($row = $result->fetch_assoc()){ echo $row[“SID”] . “, “; echo $row[“fname”] . “, “; echo $row[“lname”] . “, “; echo $row[“age”] . “<br>“; }

$result->fetch_row() while($row = $result->fetch_row()){ echo $row[0] . “, “; echo $row[1] . “, “; echo $row[2] . “, “; echo $row[3] . “<br>“; }

$result->fetch_object() while($row = $result->fetch_object()){ echo $row->SID . “, “; echo $row->fname . “, “; echo $row->lname . “, “; echo $row->age. “<br>“; }

Important result set attributes and methods Attribute/Method Description $result->num_rows Returns the number of rows in the result set. $result->field_count Returns the number of fields from specified result set. $result->data_seek ( int $offset ) Seeks to an arbitrary result pointer specified by the offset in the result set. The offset must be between (0 to result->num_rows -1) $result->free() Frees the memory associated with a result

Inserting into the Database Prepare a query string, then call the mysqli query method: $query = “insert into students (SID, fname, lname, age, dept) values (‘800456783’,‘Bob’,’Smith’,25,’SIS’)”; $result = $db->query($query); In case of INSERT the query method returns true if the insert is successful and false if there is an error.

Inserting into the Database Checking the result status after an insert: if ($result) { echo $db->affected_rows." students inserted into database."; } else { echo "An error has occurred. The item was not added."; }

Other Database Object Methods and Attributes $db->affected_rows Returns the number of rows affected by the last INSERT, UPDATE, REPLACE or DELETE query. For SELECT statements returns the number of returned rows. $db->close() Closes a previously opened database connection For a detailed description of mysqli class check: http://us2.php.net/manual/en/mysqli.summary.php

Using Prepared Statements Mysqli library supports the use of prepared statements. Prepared statements are useful for speeding up execution when you are performing large numbers of the same query with different data. They also protect against SQL injection-style attacks.

Using Prepared Statements $query = "insert into students (SID, fname, lname, age, dept) values(?, ?, ?, ?, ?)"; $stmt = $db->prepare($query); $stmt->bind_param("sssds", $sid, $fname, $lname, $age, $dept); $sid = “800999234”; $fname=“Bob”; $lname=“Smith”; $age=23; $dept=“SIS”; $stmt->execute(); echo $stmt->affected_rows.' students inserted into database.'; $stmt->close(); Char Description i Variable has type integer d Variable has type double s Variable has type string b Variable has type blob