Is this method of insert correct when using mysqli - php

Question

I just want to know that when it comes to inserting data into database using mysqli, if this is the best way to do it below or is there a much better way?
$insert = array();
for ($i = 1, $n = $_SESSION['sessionNum']; $i <= $n; ++$i)
{
$insert[] = "'". mysqli_real_escape_string( $_SESSION['id'] ) . ($n == 1 ? '' : $i) . "','". mysqli_real_escape_string( $_SESSION['timeChosen'] ) ."','". mysqli_real_escape_string( date("Y-m-d", strtotime( $_SESSION['dateChosen'] ) ) ) ."'
,'". mysqli_real_escape_string( $_SESSION['textWeight'] ) ."','". mysqli_real_escape_string( $time ) ."','". mysqli_real_escape_string( $_SESSION['textMarks'] ) ."'
,'". mysqli_real_escape_string( $_SESSION['module'] ) ."','". mysqli_real_escape_string( $teacherid ) ."','". mysqli_real_escape_string( $_SESSION['rooms'] ) ."'";
}
$insertsql = "INSERT INTO Session (SessionId, SessionTime, SessionDate, SessionWeight, SessionDuration, TotalMarks, ModuleId, TeacherId, Room)
VALUES (" . implode('), (', $insert) . ")";
$sqlstmt=$mysqli->prepare($insertsql);
$sqlstmt->execute();

Answer 1

The whole point of using prepared statements is to avoid doing half of the work you are doing. The basic idea is that you just create the basic query, prepare it and tell it the variable names you will use instead of the placeholders and then do all the work on the variables.
Your code should be something as follows:
$insertsql = "INSERT INTO Session (SessionId, SessionTime, SessionDate, SessionWeight, SessionDuration, TotalMarks, ModuleId, TeacherId, Room) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
$insert = $mysqli->prepare($insertsql);
$insert->bind_params("sssssssss", $sessid, $_SESSION['timeChosen'], $sessdate,
$_SESSION['textWeight'], $time, $_SESSION['textMarks'],
$_SESSION['module'], $teacherid, $_SESSION['rooms']);
for ($i = 1, $n = $_SESSION['sessionNum']; $i <= $n; ++$i) {
$sessid = $_SESSION['id'] . ($n == 1 ? '' : $i);
$sessdate = date("Y-m-d", strtotime($_SESSION['dateChosen']));
$insert->execute();
}
$insert->close(); /* free resources */

Answer 2

It's best to use PDO, and to use a prepared query to which you bind your values. If you have a lot of values to fill in then you can just use positionally based placeholders instead of namebased ones.
<?php
// connect to your database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', "username", "password");
// fill in the array, just one after the other since the placeholders will be numbered from 1 to ->count($insert)
$insert = array();
for ($i = 1, $n = $_SESSION['sessionNum']; $i <= $n; ++$i){
$insert[] = $_SESSION['id'] . ($n == 1 ? '' : $i);
$insert[] = $_SESSION['timeChosen'];
$insert[] = date("Y-m-d", strtotime( $_SESSION['dateChosen']));
$insert[] = $_SESSION['textWeight'];
$insert[] = $time;
$insert[] = $_SESSION['textMarks'];
$insert[] = $_SESSION['module'];
$insert[] = $teacherid;
$insert[] = $_SESSION['rooms'];
}
$query = $pdo->prepare('INSERT INTO Session
(SessionId, SessionTime, SessionDate, SessionWeight,
SessionDuration, TotalMarks, ModuleId, TeacherId, Room)
VALUES' .
//repeat the 9 placeholders for $_SESSION['sessionNum'] and cut of the trailing ,
substr(str_repeat('(?,?,?,?,?,?,?,?,?),',$_SESSION['sessionNum']),0,-1));
// now we bind the placeholder with the corresponding value in the array
for($i = 0;$i < count($insert);$i++){
$query->bindParam(($i + 1),$insert[$i]);
}
// finally we execute the query
$query->execute();
And that's it really. (I wrote this from memory, haven't tested it but for php -l but you get the general idea and I'm pretty sure it'll work. ;) )