Prepared statements and stored procedures

Many of the more mature databases support the concept of prepared statements. What are they? They can be thought of as a kind of compiled template for the SQL that an application wants to run, that can be customized using variable parameters. Prepared statements offer two major benefits:

The query only needs to be parsed (or prepared) once, but can be executed multiple times with the same or different parameters. When the query is prepared, the database will *** yze, compile and optimize it’s plan for executing the query. For complex queries this process can take up enough time that it will noticeably slow down an application if there is a need to repeat the same query many times with different parameters. By using a prepared statement the application avoids repeating the *** yze/compile/optimize cycle. This means that prepared statements use fewer resources and thus run faster. The parameters to prepared statements don’t need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).

Prepared statements are so useful that they are the only feature that PDO will emulate for drivers that don’t support them. This ensures that an application will be able to use the same data access paradigm regardless of the capabilities of the database.

大约的翻译是：

许多更老练的数据库都支撑预处理句子的概念。这些是什么？它能够被认为是作为一种经过编译SQL句子模板来运转sql句子的机制。预处理句子能够带来两大优点：

Warning

The method in the below example can only be used with character sets that share the same lower 7 bit representation as ASCII, such as ISO-8859-1 and UTF-8. Users using character sets that have different representations (such as UTF-16 or Big5) must use the charset option provided in PHP 5.3.6 and later versions.

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

下面是经过 wireshark 抓到的数据包，来详细显现PDO 查询的进程：

绑定的变量：

假如不履行  $pdo ->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); PDO 仅仅会将刺进的参数运用本地转义之后和SQL模板组装起来，然后一同发送给Mysql Server。这实际上与运用mysql_real_escape_string()过滤，然后组装这种做法并没有什么不同。

A. 经过增加(php 5.3.6曾经版别)：$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

B.  升级到php 5.3.6 (不必设置PDO::ATTR_EMULATE_PREPARES也能够)

为了程序移植性和一致安全性，主张运用$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false)办法