Saifur's Blog
Database in PHP

Database in PHP

Saifur Rahman Mahin's photo
Saifur Rahman Mahin
·

12 min read

Table of contents

Database in PHP

Creating a database-driven application in PHP involves several steps, from designing your database schema to connecting to the database and performing CRUD (Create, Read, Update, Delete) operations. Below is a step-by-step guide to help you get started:

Step 1: Database Design

  1. Identify Requirements:

    • Understand the requirements of your application.

    • Identify the entities and their relationships.

  2. Create a Database Schema:

    • Use a tool like MySQL Workbench or draw a diagram on paper.

    • Define tables, columns, and relationships.

Step 2: Set Up Your Development Environment

  1. Install a Web Server:

    • Use Apache, Nginx, or any other web server.

    • For local development, you can use tools like XAMPP, MAMP, or WampServer.

  2. Install PHP and MySQL:

    • Install PHP and MySQL on your server or local environment.

Step 3: Connect to the Database

  1. Configure Database Connection:

    • Set up database connection parameters in a configuration file.

    • Use mysqli or PDO (PHP Data Objects) for database connectivity.

  2. Test the Connection:

    • Write a simple PHP script to test the database connection.

Step 4: Perform CRUD Operations

  1. Create (Insert) Data:

    • Write PHP scripts to insert data into the database.

    • Validate user input before inserting data.

  2. Read Data:

    • Create PHP scripts to fetch and display data from the database.

    • Implement basic search and filtering functionalities.

  3. Update Data:

    • Develop scripts to update existing records in the database.

    • Implement forms for users to edit data.

  4. Delete Data:

    • Write PHP scripts to delete records from the database.

    • Implement confirmation mechanisms to prevent accidental deletions.

Step 5: Implement Security Measures

  1. Sanitize User Input:

    • Use prepared statements or parameterized queries to prevent SQL injection.

  2. Authenticate Users:

    • Implement user authentication to control access to certain parts of your application.

  3. Authorize Users:

    • Assign roles and permissions to users based on their responsibilities.

Step 6: Error Handling and Logging

  1. Implement Error Handling:

    • Use try-catch blocks to handle exceptions gracefully.

    • Provide meaningful error messages to users and log detailed errors for developers.

Step 7: Optimize and Fine-Tune

  1. Optimize Database Queries:

    • Ensure that your SQL queries are efficient.

    • Index columns used in search and join operations.

  2. Caching:

    • Implement caching mechanisms to reduce database queries, especially for frequently accessed data.

Step 8: Testing

  1. Unit Testing:

    • Write unit tests for your database-related functions.

  2. Integration Testing:

    • Test the entire application with a focus on database interactions.

Step 9: Deployment

  1. Secure Deployment:

    • Configure production settings, including secure database credentials.

    • Ensure that error reporting is appropriately configured for a production environment.

  2. Backups:

    • Implement regular database backups to prevent data loss.

Remember to adapt these steps to your specific project requirements and scale. Additionally, stay updated with PHP and database best practices to ensure the security and performance of your application.

Connecting to a database in PHP

Connecting to a database in PHP involves setting up a configuration file with the necessary parameters and then using either mysqli or PDO for the actual database connection. Below are step-by-step instructions using both mysqli and PDO.

Using MySQLi:

  1. Create a Configuration File (config.php):

     <?php
 define('DB_HOST', 'your_host');
 define('DB_USER', 'your_username');
 define('DB_PASSWORD', 'your_password');
 define('DB_NAME', 'your_database_name');

  2. Connect using MySQLi (connect.php):

     <?php
 require_once 'config.php';

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Use $conn for database operations
 // ...

 // Close connection when done
 $conn->close();

Using PDO:

  1. Create a Configuration File (config.php):

     <?php
 define('DB_HOST', 'your_host');
 define('DB_USER', 'your_username');
 define('DB_PASSWORD', 'your_password');
 define('DB_NAME', 'your_database_name');

  2. Connect using PDO (connect.php):

     <?php
 require_once 'config.php';

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Use $pdo for database operations
     // ...

     // Close connection (not necessary for PDO)
     $pdo = null;
 } catch (PDOException $e) {
     // Handle connection errors
     echo "Connection failed: " . $e->getMessage();
 }

Replace 'your_host', 'your_username', 'your_password', and 'your_database_name' with your actual database connection details.

Choose either the MySQLi or PDO approach based on your preferences. PDO is more flexible as it supports multiple database systems, whereas MySQLi is MySQL-specific but may offer some specific MySQL features.

CRUD operations

CRUD operations stand for Create, Read, Update, and Delete, which are basic operations performed on data in a database. To perform CRUD operations in PHP, you typically need to connect to a database (e.g., MySQL) and execute SQL queries. Below is a simple example using PHP and MySQL for a basic CRUD system:

1.Create (Insert) operation

Below are examples of how you can perform the Create (Insert) operation using both mysqli and PDO, including input validation to enhance security.

Using MySQLi:

  1. Insert Data (insert_data_mysqli.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $name = $_POST['name'] ?? '';
 $email = $_POST['email'] ?? '';

 if (empty($name) || empty($email)) {
     die("Name and Email are required.");
 }

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Prepare and execute the SQL statement
 $stmt = $conn->prepare("INSERT INTO your_table_name (name, email) VALUES (?, ?)");
 $stmt->bind_param("ss", $name, $email);

 if ($stmt->execute()) {
     echo "Data inserted successfully";
 } else {
     echo "Error: " . $stmt->error;
 }

 // Close statement and connection
 $stmt->close();
 $conn->close();

Using PDO:

  1. Insert Data (insert_data_pdo.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $name = $_POST['name'] ?? '';
 $email = $_POST['email'] ?? '';

 if (empty($name) || empty($email)) {
     die("Name and Email are required.");
 }

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Prepare and execute the SQL statement
     $stmt = $pdo->prepare("INSERT INTO your_table_name (name, email) VALUES (:name, :email)");
     $stmt->bindParam(':name', $name);
     $stmt->bindParam(':email', $email);

     $stmt->execute();

     echo "Data inserted successfully";
 } catch (PDOException $e) {
     // Handle errors
     echo "Error: " . $e->getMessage();
 } finally {
     // Close connection (not necessary for PDO)
     $pdo = null;
 }

Replace 'your_table_name' with the actual name of your table. These examples assume that you have a table with columns 'name' and 'email'. Adjust the code based on your specific table structure and validation requirements.

2.Read operation, fetching and displaying data from the database

Below are examples of how you can perform the Read operation, fetching and displaying data from the database with basic search and filtering functionalities using both mysqli and PDO.

Using MySQLi:

  1. Read Data (read_data_mysqli.php):

     <?php
 require_once 'config.php';

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Fetch and display data
 $sql = "SELECT * FROM your_table_name";
 $result = $conn->query($sql);

 if ($result->num_rows > 0) {
     while ($row = $result->fetch_assoc()) {
         echo "Name: " . $row['name'] . " - Email: " . $row['email'] . "<br>";
     }
 } else {
     echo "No records found";
 }

 // Close connection
 $conn->close();

Using PDO:

  1. Read Data (read_data_pdo.php):

     <?php
 require_once 'config.php';

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Fetch and display data
     $stmt = $pdo->query("SELECT * FROM your_table_name");

     if ($stmt->rowCount() > 0) {
         while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
             echo "Name: " . $row['name'] . " - Email: " . $row['email'] . "<br>";
         }
     } else {
         echo "No records found";
     }
 } catch (PDOException $e) {
     // Handle errors
     echo "Error: " . $e->getMessage();
 } finally {
     // Close connection (not necessary for PDO)
     $pdo = null;
 }

Replace 'your_table_name' with the actual name of your table. These examples retrieve all records from the table and display them. You can modify the SQL query to implement search and filtering functionalities based on your specific requirements. For instance, you can use a WHERE clause to filter records based on certain criteria.

3.Updating existing records in a database

Updating existing records in a database involves creating scripts that can handle the update operation. Below are examples of how you can perform the Update operation using both mysqli and PDO, along with a basic form for users to edit data.

Using MySQLi:

  1. Update Data Script (update_data_mysqli.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';
 $name = $_POST['name'] ?? '';
 $email = $_POST['email'] ?? '';

 if (empty($id) || empty($name) || empty($email)) {
     die("ID, Name, and Email are required.");
 }

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Prepare and execute the SQL statement
 $stmt = $conn->prepare("UPDATE your_table_name SET name = ?, email = ? WHERE id = ?");
 $stmt->bind_param("ssi", $name, $email, $id);

 if ($stmt->execute()) {
     echo "Data updated successfully";
 } else {
     echo "Error: " . $stmt->error;
 }

 // Close statement and connection
 $stmt->close();
 $conn->close();

  2. Edit Data Form (edit_form.php):

     <!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
     <title>Edit Data</title>
 </head>
 <body>
     <?php
     // Fetch existing data based on ID
     $id = $_GET['id'] ?? '';
     $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

     // Check connection
     if ($conn->connect_error) {
         die("Connection failed: " . $conn->connect_error);
     }

     $result = $conn->query("SELECT * FROM your_table_name WHERE id = $id");

     if ($result->num_rows > 0) {
         $row = $result->fetch_assoc();
     } else {
         die("Record not found");
     }

     $conn->close();
     ?>

     <h2>Edit Data</h2>
     <form action="update_data_mysqli.php" method="post">
         <input type="hidden" name="id" value="<?php echo $row['id']; ?>">
         Name: <input type="text" name="name" value="<?php echo $row['name']; ?>"><br>
         Email: <input type="text" name="email" value="<?php echo $row['email']; ?>"><br>
         <input type="submit" value="Update">
     </form>
 </body>
 </html>

Using PDO:

  1. Update Data Script (update_data_pdo.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';
 $name = $_POST['name'] ?? '';
 $email = $_POST['email'] ?? '';

 if (empty($id) || empty($name) || empty($email)) {
     die("ID, Name, and Email are required.");
 }

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Prepare and execute the SQL statement
     $stmt = $pdo->prepare("UPDATE your_table_name SET name = :name, email = :email WHERE id = :id");
     $stmt->bindParam(':name', $name);
     $stmt->bindParam(':email', $email);
     $stmt->bindParam(':id', $id);

     $stmt->execute();

     echo "Data updated successfully";
 } catch (PDOException $e) {
     // Handle errors
     echo "Error: " . $e->getMessage();
 } finally {
     // Close connection (not necessary for PDO)
     $pdo = null;
 }

  2. Edit Data Form (edit_form.php):

     <!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
     <title>Edit Data</title>
 </head>
 <body>
     <?php
     // Fetch existing data based on ID
     $id = $_GET['id'] ?? '';
     try {
         // Create a new PDO instance
         $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

         // Set the PDO error mode to exception
         $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

         $stmt = $pdo->prepare("SELECT * FROM your_table_name WHERE id = :id");
         $stmt->bindParam(':id', $id);
         $stmt->execute();

         $row = $stmt->fetch(PDO::FETCH_ASSOC);

     } catch (PDOException $e) {
         // Handle errors
         echo "Error: " . $e->getMessage();
     } finally {
         // Close connection (not necessary for PDO)
         $pdo = null;
     }
     ?>

     <h2>Edit Data</h2>
     <form action="update_data_pdo.php" method="post">
         <input type="hidden" name="id" value="<?php echo $row['id']; ?>">
         Name: <input type="text" name="name" value="<?php echo $row['name']; ?>"><br>
         Email: <input type="text" name="email" value="<?php echo $row['email']; ?>"><br>
         <input type="submit" value="Update">
     </form>
 </body>
 </html>

Replace 'your_table_name' with the actual name of your table. These examples assume that you have a table with columns 'id', 'name', and 'email'. Adjust the code based on your specific table structure and validation requirements.

4.Deleting records from a database

Deleting records from a database is a critical operation, and it's important to implement confirmation mechanisms to prevent accidental deletions. Below are examples of how you can perform the Delete operation using both mysqli and PDO, along with a basic confirmation mechanism.

Using MySQLi:

  1. Delete Data Script (delete_data_mysqli.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';

 if (empty($id)) {
     die("ID is required.");
 }

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Fetch existing data based on ID
 $result = $conn->query("SELECT * FROM your_table_name WHERE id = $id");

 if ($result->num_rows > 0) {
     $row = $result->fetch_assoc();
 } else {
     die("Record not found");
 }

 // Display confirmation form
 echo "Are you sure you want to delete the following record?<br>";
 echo "ID: " . $row['id'] . "<br>";
 echo "Name: " . $row['name'] . "<br>";
 echo "Email: " . $row['email'] . "<br>";
 echo "<form action='confirm_delete_mysqli.php' method='post'>";
 echo "<input type='hidden' name='id' value='" . $row['id'] . "'>";
 echo "<input type='submit' value='Yes, delete'>";
 echo "</form>";

 // Close connection
 $conn->close();

  2. Confirmation and Delete Script (confirm_delete_mysqli.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';

 if (empty($id)) {
     die("ID is required.");
 }

 // Create connection
 $conn = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

 // Check connection
 if ($conn->connect_error) {
     die("Connection failed: " . $conn->connect_error);
 }

 // Prepare and execute the SQL statement to delete the record
 $stmt = $conn->prepare("DELETE FROM your_table_name WHERE id = ?");
 $stmt->bind_param("i", $id);

 if ($stmt->execute()) {
     echo "Record deleted successfully";
 } else {
     echo "Error: " . $stmt->error;
 }

 // Close statement and connection
 $stmt->close();
 $conn->close();

Using PDO:

  1. Delete Data Script (delete_data_pdo.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';

 if (empty($id)) {
     die("ID is required.");
 }

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Fetch existing data based on ID
     $stmt = $pdo->prepare("SELECT * FROM your_table_name WHERE id = :id");
     $stmt->bindParam(':id', $id);
     $stmt->execute();

     if ($stmt->rowCount() > 0) {
         $row = $stmt->fetch(PDO::FETCH_ASSOC);
     } else {
         die("Record not found");
     }

     // Display confirmation form
     echo "Are you sure you want to delete the following record?<br>";
     echo "ID: " . $row['id'] . "<br>";
     echo "Name: " . $row['name'] . "<br>";
     echo "Email: " . $row['email'] . "<br>";
     echo "<form action='confirm_delete_pdo.php' method='post'>";
     echo "<input type='hidden' name='id' value='" . $row['id'] . "'>";
     echo "<input type='submit' value='Yes, delete'>";
     echo "</form>";

 } catch (PDOException $e) {
     // Handle errors
     echo "Error: " . $e->getMessage();
 } finally {
     // Close connection (not necessary for PDO)
     $pdo = null;
 }

  2. Confirmation and Delete Script (confirm_delete_pdo.php):

     <?php
 require_once 'config.php';

 // Validate user input (you can customize this based on your requirements)
 $id = $_POST['id'] ?? '';

 if (empty($id)) {
     die("ID is required.");
 }

 try {
     // Create a new PDO instance
     $pdo = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME, DB_USER, DB_PASSWORD);

     // Set the PDO error mode to exception
     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

     // Prepare and execute the SQL statement to delete the record
     $stmt = $pdo->prepare("DELETE FROM your_table_name WHERE id = :id");
     $stmt->bindParam(':id', $id);

     if ($stmt->execute()) {
         echo "Record deleted successfully";
     } else {
         echo "Error: " . $stmt->errorInfo()[2];
     }

 } catch (PDOException $e) {
     // Handle errors
     echo "Error: " . $e->getMessage();
 } finally {
     // Close connection (not necessary for PDO)
     $pdo = null;
 }

Replace 'your_table_name' with the actual name of your table. These examples assume that you have a table with columns 'id', 'name', and 'email'. Adjust the code based on your specific table structure and validation requirements.

Did you find this article valuable?

Support Saifur's Blog by becoming a sponsor. Any amount is appreciated!

PHPMySQLDatabases