Here's an example of how you might use the prepared query functionality in PHP (straight from the docs!):

if ($stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?"))
{
	$stmt->bind_param("s", $city);
	$stmt->execute();
 
	$stmt->bind_result($district);
	$stmt->fetch();
 
	printf("%s is in district %s\n", $city, $district);
 
	$stmt->close();
}

It's a pretty reasonable-looking way of building a query. Here's how you would have to build that query normally:

$mysqli->query("SELECT District FROM City WHERE Name='" 
	. $mysqli->real_escape_string($city) . "'");

Once you want to start using a lot of random static strings in your query, it can get pretty messy – having to concatenate all of those strings together, calling that escape function everywhere – using the bind_param function makes things a lot more readable.

IF YOU'RE AN IDIOT!

No wait, hear me out, I didn't mean it like that – what I meant to say is, the prepared query syntax is probably doing more work than you expect it to.

See, prepared statements are actually a SQL thing, not something that the PHP devs added to the mysqli wrapper just because they thought it would be cool. You can use prepared statements from the MySQL command line, too:

PREPARE my_statement FROM 'SELECT District FROM City WHERE Name=?';
SET @city := 'Amersfoort';
EXECUTE my_statement USING @city;
DEALLOCATE PREPARE my_statement;

mysqli::prepare is just giving you access to this nifty feature, which is fine and dandy. However, you may have noticed something -

That's a lot of queries to run, just to run a single SELECT query!

Now, if you're going to be running a ton of INSERT or UPDATE queries, and you just want to swap the variables out each time, you're fine – letting MySQL hang on to the meat of a query you're going to be running a hundred times is downright reasonable.

BUT – if all you're doing is running a half dozen queries while you're building a web page to display to the user, the only thing you're doing is increasing the number of times you have to contact the server.

How many superfluous database-contacts will there be? As far as I can tell, you'll be contacting the server three times more than you need to:

• Once to prepare the statement
• Once to send the parameters to the server and get the results back
• Once to deallocate the statement

(I haven't looked at the source code, but I'm guessing that commenter Angus M is correct in his assessment that binding a parameter does not cause communication with the database.)

If your database server is running on the same host as your web server, the cost of contacting the database is probably pretty low. Still, after years of developing thinnish-desktop clients, my instinct is to avoid that overhead wherever possible.

Stuck between a rock and an inefficient place

I imagine that, among the people who took those last few paragraphs seriously, there are two camps – the coders who will say "well, whatever" and keep writing queries using the prepare syntax because it's more convenient and easier to read (which is an argument I can understand), and the efficiency advocates who will give a tortured sigh and go back to writing queries with lots of awkward concatenation, in order to avoid overhead.

Or you could write/copy some simple query-building tools that do the stuff that you originally thought mysqli::prepare was doing!

Here's a function I threw together last night, which I imagine would suit the needs of many developers using PHP/MySQL:

<?php
 
function GetQueryWithData()
{
	$Query = "";
	$ParameterNumber = 0;
 
	if (func_num_args() && $Query = func_get_arg($ParameterNumber++))
	{
		while ($ParameterNumber < func_num_args())
		{
			$NextParameter = func_get_arg($ParameterNumber++);
			$PlaceToInsertParameter = strpos($Query, '?');
			if ($PlaceToInsertParameter !== false)
			{
				$QuerySafeString = '';
 
				if (is_bool($NextParameter))
				{
					$QuerySafeString = $NextParameter ? 'TRUE' : 'FALSE';
				}
				else if (is_float($NextParameter) || is_int($NextParameter))
				{
					$QuerySafeString = $NextParameter;
				}
				else if (is_null($NextParameter))
				{
					$QuerySafeString = 'NULL';
				}
				else
				{
					$QuerySafeString = "'" . mysql_escape_string($NextParameter) . "'";
				}
 
				$Query = substr_replace($Query, $QuerySafeString, $PlaceToInsertParameter, 1);
			}
		}
	}
 
 
	return $Query;
}
 
print GetQueryWithData("SELECT * FROM `ass` WHERE `butt` = ? AND `cheek_id` = ? AND ? "
	. "AND `nullable_field` IS ? ", 
	"lol 'WUT'", 13, true, null) . "\n";
/* SELECT * FROM `ass` WHERE `butt` = 'lol \'WUT\'' AND `cheek_id` = 13 AND TRUE 
	AND `nullable_field` IS NULL */
 
print GetQueryWithData('UPDATE `some_table` SET `some_column` = ?, `some_other_column` = ?, '
	. '`some_id` = ? WHERE `yourface` = ?', '20', 
	21, 69, 'sucks') . "\n";
/* UPDATE `some_table` SET `some_column` = '20', `some_other_column` = 21, 
	`some_id` = 69 WHERE `yourface` = 'sucks' */
?>

The above function is a simple way to build a query with any number of parameters. Strings will be escaped, numbers will not be quoted, and the function never contacts the database server.

Using this function, you can redux the query from the original example while only contacting the database once:

$mysqli->query(GetQueryWithData("SELECT District FROM City WHERE Name=?", $city));

If you don't want to use that function, or roll your own query-builder, you can keep using mysqli's wrapper for prepared statements – just know that it was made for a different purpose, and it comes with a bit more cost.

Edit: PDO!

After some discussion with ss23 in #mysql, I thought I'd better add some comments about the PDO class.

On the surface (and according to much of the documentation), it appears to be a more generic (not just MySQL-specific) database wrapper with similar prepared-statement support. However, it turns out that by default, it only fakes prepared statements!

So, it is possible to use PDO to write queries using a bind-parameter syntax that can make your code a lot easier to read, and simultaneously avoid contacting the database too often. However, if that is how you decide to roll, I would recommend turning on fake-prepared-statements mode explicitly, just in case that default gets changed in the future:

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, 1);

However, this is what I've used in most scripts I've thrown together in the last few years – I hate having to throw a mysql_error call after every query, y'know?

<?php
 
define('CLIENT_LONG_PASSWORD', 1);
 
class MySQLWrapper
{
	var $server_port	=		'localhost:3306';
	var $database 		=		'whatever';
	var $username 		=		'a username';
	var $password 		=		'a password';
	var $force_long_password = false;
	var $db_object;
 
	function __construct($server_port = "", $database = "", $username = "", $password = "", $force_long_password = false)
	{
		$this->server_port = $server_port;
		$this->database = $database;
		$this->username = $username;
		$this->password = $password;
		$this->force_long_password = $force_long_password;
 
		if ($this->server_port != "")
		{
			$this->Connect();
		}
	}
 
	function Connect()
	{
		if (isset($this->db_object))
		{
			if (!mysql_ping($this->db_object))
			{
				unset($this->db_object);
				$this->Connect();
			}
		}
		else
		{
			$db_object = mysql_connect($this->server_port, $this->username, $this->password, false, $this->force_long_password ? CLIENT_LONG_PASSWORD : 0);
			if ($this->database != '' && !mysql_select_db($this->database))
			{
				$result = mysql_error();
				print "Select database failed for $this->database: $result\n";
			}
		}
	}
 
	function Disconnect()
	{
		$return = true;
 
		if (isset($this->db_object))
		{
			$return = mysql_close($this->db_object);
			unset($this->db_object);
		}
 
		return $return;
	}
 
	function Execute($query)
	{
		$this->Connect();
		$result = mysql_query($query);
		if (!$result)
		{
			$result = mysql_error();
			print "Query failed: $result\n";
			print "Teh query itself: $query\n";
		}
		return $result;
	}
}
 
?>

You may find this slightly better than using PHP's MySQL functions straight out of the box. Or not. Who can say?

I don't even know why I felt like writing this.

This script will keep a certain percentage of the tables in your MySQL database locked. It will lock the first N% of your database, and then move forward one table at a time, locking the next table in line and releasing the lock on the one at the end of the tail.

Why would someone use this script? For benchmarking some completely unrealistic scenario? To decrease database efficiency for no good reason? Who can say.

Note: you'll get to lock/release tables a lot more quickly if you run this script locally.

<?php
 
$percentage_of_database_to_lock = .25;
 
require('./shared/mysql.php');
 
$mysql = new MySQLWrapper();
$mysql->server_port = 'host:3306';
$mysql->database = 'some_db';
$mysql->username = 'some_user';
$mysql->password = 'some_pass';
 
$res = $mysql->Execute('SHOW TABLES');
 
$tables = array();
 
if ($res)
{
	while ($row = mysql_fetch_array($res))
	{
		$tables[] = $row[0];
	}
}
 
$tables_to_lock = floor($percentage_of_database_to_lock * count($tables));
 
if ($tables_to_lock > 1)
{
	$cycles = 0;
	$start_at = 0;
 
	while (true)
	{
		$query = 'LOCK TABLE';
		$tables_so_far = 0;
 
		while ($tables_so_far < $tables_to_lock)
		{
			$next_index = $start_at + $tables_so_far;
			if($next_index >= count($tables))
			{
				$next_index = $next_index - count($tables);
			}
 
			$query .= '`' . $tables[$next_index] . '` WRITE, ';
			$tables_so_far++;
		}
 
		$query = substr($query, 0, strlen($query) - 2);
 
		$mysql->Execute($query);
 
		$start_at++;
 
		if ($start_at > count($tables))
		{
			$start_at = 0;
			print "Cycle " . ++$cycles . "\n";
		}
	}
}
 
?>

Dependencies: MySQLWrapper

I decided to open up by looking for traditional profanities – a commonly-accepted method of gauging the state of a project (see: profanities in the Linux kernel, graphed over time and a quick look at the Win2k source).

Below, I provide a list of my findings, with a few examples. Enjoy a look at the source code of a functioning product with many users!

Disclaimer: if any of the words that you are about to read will offend you, then don't read them.

The classics

I started off by looking for looking for the current English classics:

Fuck: 6 times.
Example:

// If they had any unsaved changes, they're pretty much fucked, because
// this customer has apparently been modified by another screen.

Shit: 10

// For now, I believe that all the data is updated on the fly, so saving first is not
// necessary, but maybe we should just for shits and giggles

Crap: 22
The expletive for the more vocabulary-sensitive programmer!

//!!! It was late, we were tired, so I hacked this crap together !!!

// What the crap does this button do? - I disabled it because I think that this button
// is misleading and confusing

Hell: 1

// If it wasn't any of the valid options, then get the hell out

Insults

It's usually another programmer's fault.

Stupid: 75
The code is stupid, the users are stupid, other developers are stupid. According to the comments, at least.

// Clear out year if it is a stupid number

// Here we tell the user they are stupid when they do stupid things
// If the user forgets to specify a table, gently remind them that it's a good idea,
// then return

// When you minimize, it tells you you're size 0 now.  That seems stupid, ignore it

// Die, stupid message boxes

TRACE("Stupid quickbooks.\n");

IQBBasePtr stupid = response->GetDetail();
TRACE("Response Type: %d\n", (int)stupid->Type->GetValue());
InterpretResponse(stupid);

// Thigs are different (stupid) without this flag.  I don't currently support its omission

Dumb: 17

// There was some seriously wacky code here earlier including a really dumb memory leak.
// I tested my changes and they seem to work fine, nevertheless, I wasn't able
// to fully understand what this code was attempting to do so I may have missed
// some obscure feature.

Retarded: 4

// Because CStrings are retarded and don't do well with binary data, we have to copy the
// data in to the query in a rather inconvenient manner.

Idiot: 2

// Else politely inform the user that they are an idiot

Hack: 6

// Look at the first part of the label to find the operation (this is a sort of
// dirty hack so that) we don't have to change the database.

Incredulity

Really?

Why: 84
The only word with a higher count than "stupid" – there is always more for a programmer to learn. Or speculate on. Or rage at.

//!!! For some reason ODBC crashes at this point if you've already done a query !!!
//!!! I can't really figure out why !!!

// Not sure why we would want to do bitwise operations...

// WHy doesn't this exist?

// I don't see why we'd do this

// CRH asks: Why do we use Format() instead of "="? Can't we assume that it's slower?
// JDD Answers: what Formats?  What are you talking about?  You crazy, Charles!

// Removed 2006.02.17 - This makes it so that negative balances show up positive.
// I am not sure sure why it was ever here.

// This doesn't seem to work.  I'm not sure why

wtf: 25
Often heard expressed verbally by developers reading code.

catch (...)
{
	TRACE("Seriously, wtf\n");
	// sic vita est
}

// Sort the incoming files alphabetically (windows sometimes reverses the order (wtf?)

Random

Ridiculous: 2
When three syllables just isn't enough.

// Make the quantity not have ridiculous decimal places

Pants: 3
That's right, and all 3 times inside of a static string, too!

strPCProductCode = GetInitSetting(__MASTERWND, "session", "productcode", "pants");

That fourth argument is the default value, returned if there is no existing setting with that name. So… yeah.

lol: 3

// lol xor
if ((bPaid || bUnpaid) && !(bPaid && bUnpaid))

lulz: 1

// Half implemented, lulz

A few other gems

Ebonics?

// If shift was already depressed, fo' real, don't screw that up

Obvious mental deterioration:

// A grape typed this line in:
//9

And… uh… this was at the bottom of a header file…

// Standardized code makes him happy!
;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;                        ;;
;;        ;;;;;;;;        ;;
;;       ;;      ;;       ;;
;;      ;; ;;  ;; ;;      ;;
;;      ;;        ;;      ;;
;;      ;;    ;   ;;      ;;
;;      ;;        ;;      ;;
;;      ;; ;;;;;; ;;      ;;
;;       ;;  ;;  ;;       ;;
;;        ;;;;;;;;        ;;
;;                        ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;

// Non-Standardized code makes him sad!
// And keeps him up all night, screaming
;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;                        ;;
;;        ;;;;;;;;        ;;
;;       ;;;    ;;;       ;;
;;      ;; /*\/*\ ;;      ;;
;;      ;; \_/\_/ ;;      ;;
;;      ;;   ^^   ;;      ;;
;;      ;; /****\ ;;      ;;
;;      ;; \****/ ;;      ;;
;;       ;;      ;;       ;;
;;        ;;;;;;;;        ;;
;;                        ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;

8-|

So, yeah…

Found any entertaining metadata in code?  Link me!

No?

Well, how about something like CHECK or REPAIR table, then?

If you ever find yourself in the rare situation where you need to run the same query across every table in a database, this procedure might make your life easier:

DELIMITER $$
CREATE PROCEDURE `p_run_for_each_table`(IN strDatabase TEXT, IN strOperation TEXT)
    DETERMINISTIC
BEGIN
	DECLARE strQuery TEXT;
	DECLARE strTable VARCHAR(255);
	DECLARE bDone INT DEFAULT 0;
	DECLARE TableCursor CURSOR FOR
		SELECT `TABLE_NAME`
		FROM `information_schema`.`TABLES`
		WHERE `TABLE_SCHEMA` = strDatabase AND TABLE_TYPE = 'BASE TABLE';
	DECLARE CONTINUE HANDLER FOR NOT FOUND SET bDone = 1;
 
	OPEN TableCursor;
 
	REPEAT
		FETCH TableCursor INTO strTable;
 
		SET @QueryThatWasPassedIn := REPLACE(
			REPLACE(strOperation, '{?database}', strDatabase)
			, '{?table}', strTable);
 
		PREPARE Statement FROM @QueryThatWasPassedIn;
		EXECUTE Statement;
	UNTIL bDone END REPEAT;
 
	CLOSE TableCursor;
	DEALLOCATE PREPARE Statement;
END$$
DELIMITER ;

Useage

The procedure takes two parameters. The first one is the name of the database whose tables you want to run the query for.

The second is the query you would like to run. The strings "{?database}" and "{?table}" will be replaced with the database and table names.

CALL p_run_for_each_table('databasename', 'SELECT * FROM {?database}.{?table}');

What queries you can run

You should be able to use any queries that can be run in a prepared statement – you can find the list about two-thirds of the way down this page.

As of MySQL 5.1, you can run these queries: "ALTER TABLE, CALL, COMMIT, CREATE INDEX, CREATE TABLE, DELETE, DO, DROP INDEX, DROP TABLE, INSERT, RENAME TABLE, REPLACE, SELECT, SET, UPDATE, and most SHOW statements."

One particular error that I've seen time and time again (even from people who have been writing queries for a while) can occur when summarizing data from multiple tables that have a one-to-many relationship.

…In other words, it could occur in queries written for most database-driven software.

Solution: fix the problem by writing about it!

I wrote a page documenting the cause of the logical error, doing my best to warn people against letting it slip into their own code.

I attempted to write it so it would be easy to read, possibly even entertaining (a lofty goal for a manual on writing database queries, perhaps) – there is some colorful language and plenty of juvenile humor mixed with the tech-speak.

The doc itself is part of the wiki of the company where I work. I don't write a ton of documentation for our developers or customers (certainly not as much as I should), but whenever I do, I get this awesome feeling of usefulness. Oh, and pride. Sometimes, I feel so proud, that I feel compelled to link other people (who have no relationship to my company) to what I wrote! Ridiculous, I know.

Remember: if you write queries, it is your responsibility to guarantee that they return true and accurate data!

The other day a coworker was looking to beautify a large quantity of data spread across some MySQL tables.  I created this function to make his life easier:

DELIMITER $$
CREATE FUNCTION `f_sentence_case`(strInput TEXT, nMinimumLength INT) RETURNS TEXT
DETERMINISTIC
BEGIN
 
	DECLARE result TEXT;
	DECLARE LastSpace INT;
	DECLARE NextSpace INT;
	DECLARE NextSlash INT;
	DECLARE Word TEXT;
	DECLARE NewSentence INT;
	DECLARE PreviousCharacter CHAR(1);
	DECLARE TrimmedWord TEXT;
	DECLARE NumberOfSpaces INT;
	DECLARE Swap INT;
 
	SET strInput := CONCAT(strInput, ' ');
	SET result := '';
	SET LastSpace := 1;
	SET NextSpace := LOCATE(' ', strInput, LastSpace + 1);
	SET NextSlash := LOCATE('/', strInput, LastSpace + 1);
 
	SET NextSpace := IF(LEAST(NextSlash, NextSpace) = 0, GREATEST(NextSlash, NextSpace), LEAST(NextSlash, NextSpace));
 
	label1: WHILE NextSpace DO
 
		SET Word := SUBSTR(strInput, LastSpace, NextSpace - LastSpace);
		SET PreviousCharacter := SUBSTR(strInput, LastSpace - 1, 1);
		SET NewSentence := LastSpace = 1 OR (NewSentence AND PreviousCharacter = ' ') OR PreviousCharacter IN('.', '!', '?');
 
		SET TrimmedWord := LTRIM(Word);
		SET NumberOfSpaces := LENGTH(Word) - LENGTH(TrimmedWord);
		SET Word := TrimmedWord;
 
		# Make it lowercase if it is all uppercase
		SET Word := IF(LENGTH(Word) >= nMinimumLength AND Word NOT REGEXP '[0-9]', 
			IF(NewSentence,
				CONCAT(UCASE(SUBSTR(Word, 1, 1)), LCASE(SUBSTR(Word, 2, LENGTH(Word) - 1))),
				LCASE(Word)
			), 
			Word);
 
		SET result := CONCAT(result, REPEAT(' ', NumberOfSpaces), Word);
 
		SET Swap := LastSpace;
		SET LastSpace := NextSpace;
		SET NextSpace := LOCATE(' ', strInput, Swap + 1);
		SET NextSlash := LOCATE('/', strInput, Swap + 1);
		SET NextSpace := IF(LEAST(NextSlash, NextSpace) = 0, GREATEST(NextSlash, NextSpace), LEAST(NextSlash, NextSpace));
 
	END WHILE label1;
 
RETURN result;
 
END$$
DELIMITER ;

What it does

It seems to perform generally as I hoped it would; which is to say that it formats text to be sentence case.

More specifically, it alters all the "words" (a set of non-numeric, non-whitespace characters) that are longer than the specified minimum length.

It changes the words to be all lowercase, unless they happen to be the first word after a punctuation mark (in which case the first character of the word is made uppercase).

Useage

To clean up a field so that it is formatted in sentence case (ignoring all words with less than 3 characters), simply run this query:

UPDATE `table` SET `field` = f_sentence_case(`field`, 3);

Other than that, my only specs for the query were for it to be functional and hopefully not break my brain when I went back to read it later. If anyone has any significant improvements to it, let me know!

Some more background: I work at a company where I work with MySQL (a database engine) very often.

I was lounging around in the MySQL chat room on irc.freenode.net, and someone suggested that I try to write a MySQL quine – a database query that would return the text of the query itself.

After about half an hour of screwing around, I got it! It may not be a fantastic achievement, but I feel pretty leet about writing my first quine in a database query language.

SELECT REPLACE(@v:='SELECT REPLACE(@v:=\'2\',1+1,REPLACE(REPLACE(@v,\'\\\\\',\'\\\\\\\\\'),\'\\\'\',\'\\\\\\\'\'));',1+1,REPLACE(REPLACE(@v,'\\','\\\\'),'\'','\\\''));

Only 167 characters. Hah!