mysql view _ _ Trigger transaction function _ _ _ dynamic stored procedure Anti-SQL injection

1, views

  create:

    create view as SQL statements view name (e.g. select id, name from t1 where id> 10);

  modify:

    alter view view name as SQL statements;

  delete:

    View Name drop view;

2, the trigger:

  When a table will do the perception of manipulation (CRUD), trigger custom behavior

  demiliter // # // to change the terminator

  When create tigger t1 before insert on student for each row # t1 of the trigger named student table do insert trigger action    

  begin                        

  insert  into  loggin(lname) values(new.sname)

  insert  into  loggin(lname) values(new.sname)

  end

 

  NEW, new data, usually only generated when the insert update operation

  OLD, old data is usually generated when the delete operation

 

3, function

  python 

    def f1(a1,a2):

      return a1 + a2

  f1 ()

  Built-in functions

    Execution of the function select CURDATE ();

    blog

    id  title    ctime

    1  asdf    2019-11

    2  asdf    2019-11

    3  asdf    2019-10

    4  asdf    2019-10

    select  ctime,count(1) from log group by ctime;

    select DATE_FORMAT(ctime,"%Y-%m") from blog group by DATE_FORMAT(ctime,"%Y-%M");

    2019-11  2

    2019-10  2 

  Custom function (return value)

  

  delimiter //

    create function(

    i1 int,

    i2 int

    )

    begin

    delcare num int default 0;

    set num  = i1 + i2;

    return (whether);

    end

  delimiter ;

  

  select f1(1,100);

 

4, stored procedures

  An alias == "Save MySQL on some already written sql statement

  Call: Alias ​​();

  Used in place of programmers to write sql statement

 

  method one:

    MySQL: Stored Procedures

    Program: call a stored procedure

 

  1, simple

    delimiter //

    create procedure p1()

    begin

    select * from teacher;

    inser into student(sname) valuer('ct');

     end //

    delimiter ;

 

    call p1 (); # MySQL calls

    cursor.callproc ( 'p1') # python call

  2, pass the parameter (in, out, inout)

    delimiter //

    create procedure p2(

      in n1 int,

      in n2 int

    )

    begin

    select * from teacher where tid > n1;

    end //

    delimiter ;

    call p1 (12,2); # MySQL calls

    cursor.callproc ( 'p2', (12,2)) # Python pymysql call

 

    3, parameter out 

    delimiter //

    create procedure p3(

    in n1 int;

    out n2 int

    )

    begin

      set n2 = 123123;

      select * from student where sid > n2;

    end //

    delimiter ;

 

    # Mysql call effects to achieve the return of indirect variables by @ v1

    set @v1 = 12;

    call p3(12,@v1)

    select @ v1; # p3 call after call to @V variables into them, then n2 is actually @v, set @v from 12 to reassign 123123.

 

    # Pymysql call a stored procedure, the default mysql in the implementation of the following statements.

    set @_p3_0 = 12;

    set @_p3_1 = 2;

    call p3(@_p3_0,@_p3_1)

    select @_p3_0,@_p3_1;

 

    cursor.callproc('p3',(12,2))

    r1 = cursor.fetchal()

    print(r1)

    

    cursor.execute('select @_p3_0,@_p3_1')

    r2 = cursor.fatchall()

    print(r2)

    

    The results set out why there needs return values ​​falsified

    delimiter //

    create procedure p3(

    From in n1 int,

      Results of out n2 int procedure for identifying a stored identifier 1 is 1,2 error ERROR is normally 2

 

    )

    begin

      insert into vv(..)

      insert into vv(..)

      insert into vv(..)

    end //

    delimiter ;

 

    4, transaction

    delimiter //

    create procedure p4(

      Out Sataus int 

 

    )

    begin

      1, the statement is executed if abnormal {

      set status = 1;

      rollback;

      }

    

    Begin transaction

      --- A accounts minus 100 yuan

      --- B accounts increased 80 yuan

      --- C accounts increased 20 yuan 

      --- commit;

    End

    setstatus = 2;

    end //

    delimiter ;

    ----------------------------------------------

    Example # Affairs

    demiliter //

    create PROCEDURE P5(

      OUT p_return_code tinyint

    )

    befin

      declare exit hadler for sqlexecption

      begin

      --- ERROR

      set p_return_code = 1;

      rollback;

    end;

 

    start transaction;

      delete from tb1;

      inser into tb2(name) values('veven');

    commit;

 

    --- success

    set p_return_code =2 ;

 

    end //

    delimiter ;

    ----------------------------------------

     

    5, the cursor

      delimiter //

      create procedure p6()

      begin

      declare row_id int; - Variable 1

      declare row_num int; - Variable 2

      declare done int DEFAULT FALSE;

      declare temp int;

 

      declare my_cursor cursor for select id,num from A;

      declare continuehandler for not found set done = TRUE;

       

      open my_cursor:

        bbj:LOOP

          fetch my_cursor inti row_id,row_num;

        if done the

          leave bbj;

        end if 

        set temp = row_id + row_num

        insert into B(number) values(temp)

      end loop bbj;

      close my_cursor;

    end //

    delimiter ;

 

    6, the implementation of dynamic SQL (Anti-SQL injection)

    delimiter //

    create procedure p7(

      in tpl varchar(255)

      in arg int

    )

    begin

      1, preflight car something SQL statements legitimacy
      2, SQL = tp1 format

      3, the implementation of sql statement

 

      set @xo = arg;

      PREPARE XXX FROM 'select * from student where sid > ?';

      execute XXX using @xo; ​​# @ variables can only be used

      DEALLOCATE prepare prod;

    end //

    delimiter ;

Guess you like

Origin www.cnblogs.com/222kd/p/10882215.html