Performing DELETE operations using PHP's preprocessing statements prevents SQL injection and ensures that deletion is safe and controllable. 1. Establish a reliable database connection. It is recommended to use MySQLi or PDO; 2. Use placeholders (?) to write DELETE preprocessing statements and bind parameters through bind_param to ensure type matching; 3. Call execute() to perform deletion operations; 4. Optionally check affected_rows to confirm whether the deletion takes effect; 5. Pay attention to calling execute() multiple times during batch deletion, and explicitly close the statement to standardize the operation process.

It is actually quite straightforward to use PHP preprocessing statements to execute DELETE operations, just figure out the process and parameter binding methods. The key is to prevent SQL injection while ensuring that the deletion operation is controllable and safe.

Get ready for database connection

Before performing DELETE, you must establish a reliable database connection. PDO or MySQLi is recommended, both of which support preprocessing statements. Here, take MySQLi as an example:

 $mysqli = new mysqli("localhost", "username", "password", "database");
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

After the connection is successful, you can prepare your DELETE query.

Write DELETE preprocessing statements

The DELETE statement usually deletes data based on a certain condition, such as deleting a record with an ID. At this time, parameter binding is needed to avoid splicing SQL strings directly.

The basic structure is as follows:

 $stmt = $mysqli->prepare("DELETE FROM users WHERE id = ?");
$stmt->bind_param("i", $id);
$id = 1;
$stmt->execute();

• ? is a placeholder, indicating the variable to be passed in
• bind_param("i", $id) means binding an integer parameter, "i" means integer type
• $stmt->execute() is the actual deletion operation

This can effectively prevent SQL injection attacks.

Optional: Confirm whether the deletion is successful

Sometimes you may wonder if this deletion takes effect. You can judge by checking the number of rows that affect:

 if ($stmt->affected_rows > 0) {
    echo "Delete successfully";
} else {
    echo "No matching record was found";
}

This judgment is very helpful for debugging or user prompts. For example, when the user enters an ID that does not exist, a friendly prompt can be returned instead of a silent failure.

Notes and FAQs

• Type matching : The first parameter of bind_param is the type identifier. Commonly used are i (integer), s (string), and d (floating point number). Be sure to ensure that it is consistent with the field type.

• Multiple executions : If you need to delete different IDs in batches, you can call execute() multiple times after bind_param:

   $ids = [1, 2, 3];
  foreach ($ids as $id) {
      $stmt->bind_param("i", $id);
      $stmt->execute();
  }

• Close statement : It is best to call $stmt->close(); after execution. Although the script will be automatically released after the script is finished, it is more standard to explicitly close it.

Basically that's it. DELETE preprocessing statements are not complicated, but the details are prone to errors, especially parameter binding and type parts. As long as you follow the steps, there will generally be no problem.

The above is the detailed content of PHP prepared statement for DELETE query. For more information, please follow other related articles on the PHP Chinese website!