I've just completed my first prepared statement, converted to using them for security reasons. I've tested it and it works however I am looking for feedback (constructive criticism welcomed) regarding the code itself although I understand it 's fairly basic. Also, I have a few queries:
- Am I correct in saying you do not require using
mysqli_escape_string
if you use prepared statements? - Will using the
mysqli_stmt_get_result
function cut down on the amount of writing I have to do and be as effective? - Is using
mysqli_stmt_close
necessary? Am I correct saying that without using this function I will not be able to create another prepared statement within that script?
Here is my code:
<?php
//prepared statement example
include 'database.php';
$query = "SELECT ID FROM users WHERE email = ?";
$email = 'myemail@gmail.com';
$statement = mysqli_stmt_init($connect);
mysqli_stmt_prepare($statement, $query);
mysqli_stmt_bind_param($statement, 's', $email);
mysqli_stmt_execute($statement);
mysqli_stmt_bind_result($statement, $id);
mysqli_stmt_fetch($statement);
echo $id;
?>