PHP and MySQL - what's the difference between these queries?

[TonyRPH]

What's the difference between these two queries?

query1 said:

$result = $conn->query("SELECT page_name, keywords, description FROM meta_data WHERE device='$table';");

query2 said:

$sql="SELECT page_name, keywords, description FROM meta_data WHERE device='$table'";
$result = $conn->query($sql);

They both work the same / yield the same result (as one would expect).

Is the second one a prepared statement?

Thanks.

[akirk]

the first simply nests them together...

it is rather like maths you can do:

$var = 8x4
$var2 = $var / 2
$var2 = 16

or $var2 = (8x4)/2

you are simply combining / splitting the logic

[wombleh]

They’re the same, prepared statement would be something like this:

$result = $conn->prepare("SELECT page_name, keywords, description FROM meta_data WHERE device='?';");
$result->bind_param(“s”, $table);
$result->execute();

[TonyRPH]

Pretty much what I thought (apart from some confusion over a prepared statement).

Thanks and happy new year!

[cwis]

To use a prepared statement:
//Do this bit before you need it .
$sth = $conn->prepare("SELECT page_name, keywords, description FROM meta_data WHERE device=:device");
$sth->bindParam(':device', $table);
//You've bound the variable $table to the placeholder :device in the query.
..
..
More program
..
..
$table gets populated
..More program
..
..
//You want the result so execute the prepared statement
$sth->execute();

[droopsnoot]

wombleh said:

They’re the same, prepared statement would be something like this:

$result = $conn->prepare("SELECT page_name, keywords, description FROM meta_data WHERE device='?';");
$result->bind_param(“s”, $table);
$result->execute();

Am I right in thinking that you wouldn't really put quotes around your parameter? I use PDO and the syntax is different, but one of the good things about prepared statements is not having to deal with quotes and the like.