当您将参数绑定到 SQL 语句时,您可以提供类似 PDO::PARAM_STR
的参数类型.如果不这样做,请键入默认为 PDO::PARAM_STR
.具体设置每个参数的类型可能是什么原因?PDO::PARAM_STR 可以使用任何参数,至少在 MySQL 中我知道.我认为即使使用 PDO::PARAM_STR 也可以使用 BLOB 列.
When you bind parameters to SQL statement, you can provide parameter type like PDO::PARAM_STR
. If you don't, type defaults to PDO::PARAM_STR
. What can be the reasons to specifically set the type of each parameter? PDO::PARAM_STR works with any parameter as I know at least in MySQL. I think even with PDO::PARAM_STR can be used even with BLOB columns.
PDO::PARAM_STR 不会引入任何 SQL 注入,因为您仍然有准备好的查询.
PDO::PARAM_STR does not introduce any SQL injection because you still have prepared queries.
Using PARAM_STR
碰巧总是在列值中工作,因为 mySQL 隐式地将值转换为正确的类型,但它会失败,例如在这个查询中:
Using PARAM_STR
happens to always work in column values because mySQL implicitly converts values to the correct type where it can, but it will fail for example in this query:
$limit = 1;
$dbh->prepare("SELECT * FROM items LIMIT :limit");
$dbh->bindParam(":limit", $limit, PDO::PARAM_STR);
// Will throw "You have an error in your SQL syntax..."
绝对应该在适当的情况下使用 PARAM_INT
- 对于上述情况,并为除 mySQL 之外的数据库引擎做准备,这些引擎可能对他们的期望更严格.
one should absolutely use PARAM_INT
where appropriate - for cases like the one above, and to prepare for database engines other than mySQL that may be more strict in what they expect.
这篇关于在 PDO 中强类型参数的原因?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持跟版网!