Take the 2-minute tour ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.

This is what i had before (using the MySQL api)

$info_get = mysqli_query("SELECT * FROM `users` WHERE `uid`='".$_SESSION['uid']."'") or die(mysqli_error());
$info = mysql_fetch_assoc($info_get);

This is after I converted it to MySQLi

$var = $_SESSION['uid'];    //var is an integet
$table = "users"

if($stmt = mysqli_prepare($link, "SELECT * FROM ? WHERE `uid`=?")) {
    mysqli_stmt_bind_param($stmt, "i", $var);
    mysqli_stmt_execute($stmt);
    $info = mysqli_fetch_assoc($stmt);
}

1. Would the above two examples output the same result for $info['column']

2. require_once or include : Which one is better to use?

3. Any more advice?

share|improve this question
    
No one is answering qq. Is it better to use Object Oriented than Procedural or something? –  Wulf Dec 27 '12 at 3:36

1 Answer 1

up vote 1 down vote accepted

No need to "bump" someone will eventually get around to it. It doesn't even work that way. Your question will always be towards the top of the PHP section, assuming it hasn't been too long (days). The only thing "bumping" does is boost it to the top of the ALL Languages section which isn't likely to get too much more attention. Code Review is a lot slower than SO, so patience is required.

Would the above two examples output the same result for $info['column']

I don't think so. I was never really good with SQL, and I have never done anything with MySQLi, always preferring PDO, but correct me if I'm wrong: You have two entities to fill in your prepared statement. The first is the field for FROM, the second is the uid. The bind statement would then bind $var to the FROM field. Maybe change that first question mark back to what you had before and it looks like it should work. But again, SQL is a failing of mine, so you might want to hold out for a more definitive answer, or just try it for yourself.

require_once or include : Which one is better to use?

That really depends. And seen as you are not providing any code for consideration all I can do is just give you some general advice. The *_once() versions of require() and include() are always going to be slightly less efficient than their counterparts, but that is to be expected as they must determine if the page they are being asked to include already exists. With just a few files this difference is negligible, though typically you should still avoid it. You should always know whether a page has already been included, thus making the need for verifying it unnecessary.

Now, as to the difference between require() and include(). Again, that depends. If the page you are including is "required" to perform the next bit of operations, you should require it, otherwise you risk the PHP engine outpacing the render and failing. If it is of no consequence, then a normal include is fine.

Any more advice?

Initially, with the MySQL, or rather what you are saying is the MySQL as it still mostly looks like MySQLi, the or die() phrase should die. It was never really all that acceptable even though many sites use it to demonstrate. die() is a very inelegant way of terminating execution. The proper way would be to throw an error or render some sort of error page, with the former eventually leading to latter anyways. You especially shouldn't output the error for anyone to see, that should be saved to a log. No need to give potential malicious users more information than necessary.

$var is a very undescriptive variable, and the comment afterwards doesn't really help either. You shouldn't really rely on comments to explain your code anyways. Make your code self-documenting and comments, excluding doccomments, will become unnecessary. Why not just use $user_id, or $uid, or even just $id?

You should always avoid declaring a variable in a statement. There are some exceptions, such as in loops, but if statements should definitely be avoided. There's no way to tell, for 100%, whether an assignment was meant or a comparison. I know that's what the PHP documentation shows, but they should be ashamed of themselves. That's bad form. Abstract it.

$stmt = mysqli_prepare( $link, "SELECT * FROM ? WHERE `uid`=?" );
if( $stmt ) {

That being said, why are you adamant about the procedural style? The OOP style seems to make more sense, at least to me. There is less to type and it makes use of the $stmt object you created.

if( $stmt ) {
    $stmt->bind_param( 'i', $var );

Finally, this question is bordering on being off topic. It may have even already passed that line seen as the code you gave looks like it has errors. Be careful of that in the future.

share|improve this answer
    
Thank you very much. I will be weary of that in the future, and thanks for the general advice. –  Wulf Dec 28 '12 at 0:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.