使用预处理语句获得mysqli_num_rows（）的相同效果，是否需要在我的Case中？ tipo_personale ='D'是静态的

Question

sorry for the bother, it's been a while i'm trying to solve this issue. I've alredy search but i don't really know what so search, either in StackOverflow or in Php documentation..

i'm coding a little form in which there's thag that's should be dinamically populated by php taking the rows from a database on phpmyadmin.

now without using the prepared statements it works great:

 <div class="form-group">
    <label class="control-label col-sm-3" for="ref">
            <span class="asteriskField">
                            *
                            </span>
                            Referente/<br>Referent
                        </label>
                        <div class="col-sm-9">
                            <select class="form-control" id="ref" name="ref">
                        <option >
                        Scegliere un elemento/Select an element
                        </option>
                        <!-- populate value with php -->
                       <?php      

                                 $sel="SELECT id_persona, cognome, nome FROM personale WHERE tipo_personale='D' ORDER BY cognome,nome ASC";// D is permanent
                                $results=mysqli_query($conn, $sel);

                                $numrows = mysqli_num_rows($results);

                                if ($numrows == 0) {

                    ?>
                    <script>alert("empty!");</script>
                    <?php
                }
                     else{


                               for ($x = 0; $x < $numrows; $x++) {

                        $resrow = mysqli_fetch_row($results);
                        $id = $resrow[0];
                        $cognome = $resrow[1];
                        $nome = $resrow[2];
                        $referente="$cognome $nome";



                        echo "<option value='" .$referente . "'>" . $cognome . " " . $nome . "</option>";
                        }
                     }
                            ?>
                        </select>
                        </div>
                    </div>

Is it necessary to use prepared statements here? If yes how can i reach the same results as _mysqli_fetch_row_?

I've tried:

$tipo = 'D';
$query="SELECT id_persona, cognome, nome FROM personale WHERE 
          tipo_personale=? ORDER BY cognome,nome ASC";                          


$stmt = $conn->prepare($query);

$stmt->bind_param("s", $tipo);


$results=$stmt->execute();


 $stmt->store_result();

 $stmt->get_result();

 $numrows=$stmt->num_rows;

But it works only for $numrows, $resrow = mysqli_fetch_row($results) doesn't retrive data. thanks.

Answer 1

you could skip using prepared statements on fetching data out of your database if you trust your data (probably never) - but have to use it everytime your insert data.

it would look something like this.

$stmt = $this -> db -> prepare("INSERT INTO x (col1, col2, col3, col4) VALUES (?,?,?,?)");

$stmt -> bind_param("iiss", $val_for_col1, $val_for_col2, $val_for_col3, $val_for_col4); 

if($stmt -> execute()){
   $stmt -> close();
   return true;
}else{
   // error...
}

or for a select if you dont trust your data:

$mysqli = new mysqli("localhost", "my_user", "my_password", "world");

if (mysqli_connect_errno()) {
    printf("Connect failed: %s
", mysqli_connect_error());
    exit();
}

$city = "asdf";

if ($stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {


    $stmt->bind_param("s", $city);


    $stmt->execute();


    $stmt->bind_result($district);


    $stmt->fetch();

    printf("%s is in district %s
", $city, $district);

    $stmt->close();
}


$mysqli->close();