How to pass SQL string via function parameter [duplicate] - php

Question

This question already has an answer here:
A helper function for mysqli that dynamically binds params in prepared statement?
(1 answer)
Closed 2 years ago.
I want to create function that take SQL string as parameter and return me an array
I write this function:
function getgquery($I_sql){
$mysqli = new mysqli("localhost","root","","ACLUB");
$sql = $I_sql;
$result = $mysqli->query($sql);
$Data = array();
if(mysqli_num_rows($result)>0){
while($row = mysqli_fetch_assoc($result)){
$Data [] = $row;
}
}
return $Data;
}
And then call the function:
print_r(getgquery('SELECT * FROM `poeple`'));
But I get this error:
Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result,
bool given in N:\xampp\htdocs\test\functions.php on line 9

Answer 1

This is a good idea!
You are getting the error because you haven't enabled error reporting and you do not see the error you are getting for the typo you made in SQL.
The correct function should look something like this:
// Enable mysqli error reporting and open connection
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
$mysqli = new mysqli('localhost', 'username', 'password', 'db_test');
$mysqli->set_charset('utf8mb4'); // always set the charset
function getgquery(mysqli $mysqli, string $I_sql, array $params = []): ?array {
$stmt = $mysqli->prepare($I_sql);
if ($params) {
$stmt->bind_param(str_repeat("s", count($params)), ...$params);
}
$stmt->execute();
if ($result = $stmt->get_result()) {
return $result->fetch_all(MYSQLI_BOTH);
}
}
// with the typo fixed:
print_r(getgquery($mysqli, 'SELECT * FROM `people`'));
You need to connect once outside of your function and pass the connection as a parameter.
You need to use prepared statements!
Get rid of this useless loop and num_rows
If you think that passing the connection to this function every time is too much you can create a subclass of mysqli, for example something like this:
class DBClass extends mysqli {
public function __construct(
$host = null,
$username = null,
$passwd = null,
$dbname = null,
$port = null,
$socket = null
) {
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
parent::__construct($host, $username, $passwd, $dbname, $port, $socket);
$this->set_charset('utf8mb4');
}
public function safeQuery(string $sql, array $params = []): ?array {
$stmt = $this->prepare($sql);
if ($params) {
$stmt->bind_param(str_repeat("s", count($params)), ...$params);
}
$stmt->execute();
if ($result = $stmt->get_result()) {
return $result->fetch_all(MYSQLI_BOTH);
}
return null;
}
}
and then use it like this:
$mysqli = new DBClass('localhost', 'username', 'password', 'db_test');
$result = $mysqli->safeQuery('SELECT * FROM people WHERE id=?', [$myId]);