Prepared Statements

Prepared statements are a way of executing SQL queries that improve security and efficiency. Using prepared statements protects against SQL injections because the data is sent separately from the SQL command. This ensures that the same query can be executed safely multiple times with different parameters. In the example below, we will use this method to safely add several new types of fruit and vegetables to our table mysqli_tabela.

EXAMPLE

<?php
$server = "localhost";
$username = "root";
$password = "enterPassword";
$database = "mysqli_database";

$connection = mysqli_connect($server, $username, $password, $database);
if (!$connection) {
    die("Connection failed: " . mysqli_connect_error());
}

$table = "CREATE TABLE mysqli_table (
    id_table INT(100) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    fruit VARCHAR(255) NOT NULL,
    vegetable VARCHAR(150) NOT NULL,
    date TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
)";

if (mysqli_query($connection, $table)) {
    echo "Table 'mysqli_table' has been created successfully.";
} else {
    echo "Error: " . mysqli_error($connection);
}

mysqli_close($connection);

RESULT

The result will be displayed here...

Prepared statements allow us to do this safely, without fearing unauthorized database intrusions.

Increased security: Data is separated from the SQL command, completely preventing SQL injections.
Reusability: The same SQL statement is prepared only once and then simply executed with different data.
Speed: When handling larger volumes of data, prepared statements are faster than regular queries.
Using the prepare(), bind_param(), and execute() functions.