What is a client-side Prepared statement?

Asked

Viewed 254 times

5

I am starting to develop a page using PHP and, as I am still knowing the language, I decided to search which module to use to make the connection to a Mysql database.

From of that answer, found that the module mysql_* has already been discontinued and contains several security issues. In the same answer it indicates the use of mysqli_* and of PDO, how I was in doubt I went to compare the differences between the two.

It made me even more confused, because the mysqli_* seems to offer much more support than the PDO, however only the PDO supports client-side prepared statements.

My question is what’s the difference between Prepared statements server-side and client-side? When to use one and when to use the other?

php mysql

1 answer

5


The PDO driver is an abstract layer, and is not associated with any specific relational BD. This layer simulates client-side Prepared statements in case the server does not support Prepared statements.

The library mysqli is a specific layer for Mysql databases. Since Mysql databases support server-side Prepared statements, there is no need to simulate them.

Briefly, it uses server-side Prepared statements whenever possible. Client-side simulation is only useful when the server itself is not able to do it.

Use PDO whenever you want the extra abstraction layer - that is, if you don’t want the code to be dependent on a specific BD - or, as reported by @bfavaretto, you want to use named parameters.

  • 3

    There is another difference in the case of Mysql: with PDO it is possible to use parameters named in the state (WHERE foo = :bar), that Mysql does not natively support.

  • So, in the case of a Mysql database, the ideal is to use mysqli_*?

  • 1

    It depends on the complexity desired. If my queries were complex enough, I would use mysqli (for more flexibility), and created my own abstract layer using the standard Adapter.

  • 1

    @Felipe.Avelar PDO brings the advantage of being portable between different types of Dbms, today you are using Mysql and tomorrow you switch to Oracle and only need to change the line of code where you tell pro PDO what is the type of DBMS. Mysqli is slightly faster, but the difference is practically irrelevant. Personally I use Mysqli, but it is because of taste even.

  • 1

    @Oh yes, it’s safer to use Persistent Connections with Mysqli. It does an automatic Cleanup if your application fails in the middle of a transaction, whereas PDO does not. If a transaction ends without COMMIT/ROLLBACK, the next page will continue within the same transaction, this could be a serious issue.

Browser other questions tagged php mysql

You are not signed in. Login or sign up in order to post.