Geek Answers Handbook

Php and mysql best practices

I started working with php and mysql today. Basically, what I have is a blank page with pieces that I fill out from finding the identifier in the database. So, on my homepage, I have a url that looks like this:

<a href="content/display.php?id=id1">

And then in my display.php I have this:

<?php
    include '../includes/header.php';
    $id = $_GET['id'];
    $mysqli = new mysqli('localhost','username','password','dbname');
    if($result = $mysqli->query("SELECT * FROM portfolio WHERE id='".$id."'"))
    {
        while($row = $result->fetch_object())
        {
            $head = $row->head;
            $img1 = $row->img1;
            $img2 = $row->img2;
            $img_url = $row->imgurl;
            $img_thumb = $row->imgthumb;
            $vid = $row->vid;
            $swf = $row->swf;
            $url = $row->url;
            $url_text = $row->urltext;
            $text = $row->text;
        }
    }
    else echo $mysqli->error;
?>

This is a rare table in which not all of these fields will have information (many may be empty). They basically contain file names, and then in html I have code that looks like this:

if(isset($img1))
                    {
                        echo '<img src="images/'.$img1.'" />';
                    }

A few questions,

  • Is this the best way to do this?
  • Every time I visit display.php, do I open the database connection again? It may not be good ...
  • , , , , , , . , html. ?

!

+5
4

1) , . , , . . - . , , , . .

2) . - . , , , , , -. .

3) . PHP, .

4) sAc . SQL- , .

+6

SQL injection, cast :

$id = (int) $_GET['id'];

, mysql_real_escape_string :

+6

SQL- . :

else echo $mysqli->error;

:

else trigger_error($mysqli->error,E_USER_ERROR);

? , . , display_errors on, display_errors , log_errors .

+1

It looks like you're doing well with what you want. I don’t know how much development experience you have, but it would be nice to start learning MVC in php like CakePHP, Fuse or even Zend Framework (bleh !!!). I will save your time on more reliable applications by pre-defining your entire basic db interface, template processing, session processing and letting you worry about higher-level problems, like lunch! :)

+1
source

More articles:


All Articles