bindparam

PDO Bind Params depending on whether they exists in the query

由 笑着哭i 提交于 2019-12-08 05:35:51
问题 Lets say I have a mysql query which gets built depending on certain conditions: example $query = "SELECT * from `usertable` where users_active=:users_active"; if($mode=="archived") { $query .= " AND archived=:archived"; } $stmt = $dbpdo->prepare($query); $stmt->bindParam(':users_active', $users_active); $stmt->bindParam(':archived', $archived); $stmt->execute(); Now, if I run the above it will only work if $mode=="archived", as otherwise the named placeholder ":archived" will not be part of

PDO->bindParam, PDO->bindValue and PDO->closeCursor

由 半腔热情 提交于 2019-12-06 16:19:15
So far I have been using PDO->bindParam however while reading the manual I found PDO->bindValue from what I can tell PDO->bindValue passes by value where as PDO->bindParam passes by reference, is this the only difference? $modThread = db()->prepare("UPDATE `threads` SET `modtime` = UNIX_TIMESTAMP( ) WHERE `threadid` =:id LIMIT 1"); while(something) { $modThread->bindParam(':id', $thread); $modThread->execute(); //*******************HERE********************// } Again while reading the manual I found: PDO->closeCursor should I place it where marked? Is it optional/automatically called? Seems

How to convert MySQL-style question mark `?` bound parameters to Postgres-style `$1` bound parameter

由 倖福魔咒の 提交于 2019-12-06 13:24:21
I am converting an existing project from MySQL to Postgres. There are quite a few raw SQL literals in the code that use ? as a placeholder, e.g. SELECT id FROM users WHERE name = ? But I get this error: DB query error: error: operator does not exist: character varying = ? I don't want to convert all my existing SQL from ? to postgres-style operators like $1 . Is there some way of having node-postgres accept the question marks instead, or an utility that can convert to postgres style params? Note that some sort of Regex-based hack is not acceptable because question marks can be inside quotes,

Dynamically bind params in $bind_param(); Mysqli

由 ⅰ亾dé卋堺 提交于 2019-12-02 09:18:04
问题 I have DB class which is dealing all queries will be made to database I have mysqli prepare working fine. bind_param is also working fine but the problem is I want to define variable type dynamically. here is my code public function query($sql, $params = array()){ $this->_error = false; if($this->_query = $this->_mysqli->prepare($sql)){ $x = 1; if(count($params)){ foreach($params as $param){ $this->_query->bind_param($x, $param); $x++; } } IN PDO fist parameter defines position I guess so

Dynamically bind params in $bind_param(); Mysqli

由 我们两清 提交于 2019-12-02 06:58:58
I have DB class which is dealing all queries will be made to database I have mysqli prepare working fine. bind_param is also working fine but the problem is I want to define variable type dynamically. here is my code public function query($sql, $params = array()){ $this->_error = false; if($this->_query = $this->_mysqli->prepare($sql)){ $x = 1; if(count($params)){ foreach($params as $param){ $this->_query->bind_param($x, $param); $x++; } } IN PDO fist parameter defines position I guess so this function runs fine by setting X = 1 and x++ everytime, but in bind_param first argument defines type

bind_param() only necessary on user-inputted values or all?

由 我是研究僧i 提交于 2019-12-02 04:26:55
问题 I've been reading up on SQL injections and I couldn't find an answer to this question. I understand if I a query like this prepare("SELECT id, foo, bar FROM table WHERE username = ?"); Then I should use bind_param('s', $username) to avoid SQL injection possibilities. But what if I running my query on something that is not user-inputted but something like an auto-generated ID. Example: prepare("SELECT username, foo, bar from table where id = ?"); Where id is self-generated (auto-incremented

How to use mysqli::bind_param with an array as the second parameter

由 时光毁灭记忆、已成空白 提交于 2019-12-02 01:11:33
问题 This query is supposed to insert a new user into the 'users' table $user = DB::getInstance()->insert('users', array( 'username' => 'jim', 'password' => 'pass', 'salt' => 'salt' ) ); Corresponding insert() public function insert($table, $fields = array()) { if (count($fields)) { $keys = array_keys($fields); $values = null; $x = 1; foreach ($fields as $field) { $values .= "?"; if ($x < count($fields)) { $values .= ', '; } $x++; } $sql = "INSERT INTO users (`" . implode('`,`', $keys) . "`)

bind_param() only necessary on user-inputted values or all?

由 只谈情不闲聊 提交于 2019-12-02 00:58:54
I've been reading up on SQL injections and I couldn't find an answer to this question. I understand if I a query like this prepare("SELECT id, foo, bar FROM table WHERE username = ?"); Then I should use bind_param('s', $username) to avoid SQL injection possibilities. But what if I running my query on something that is not user-inputted but something like an auto-generated ID. Example: prepare("SELECT username, foo, bar from table where id = ?"); Where id is self-generated (auto-incremented value). Do I have to make use of bind_param('i', $id) here too or can I just prepare the query as:

What does bind_param() do?

由 杀马特。学长 韩版系。学妹 提交于 2019-11-30 03:55:17
问题 $resultSpendStmt = $connection->prepare(...); $array->bind_param("sdidi", $A, $B, $C, $D, $E); $array->execute(); $array->store_result(); $array->bind_result($F, $G, $H, $I, $J, $K); I am still a little unsure what bind_param does. Can someone give me an example as to what is means? 回答1: When you prepare an SQL statement, you can insert a placeholder ( ? ) where a column value would go, then use bind_param() to safely substitute that placeholder for the real column's value. This prevents any

Is it possible to use bind_param for ORDER BY? [duplicate]

由 本小妞迷上赌 提交于 2019-11-28 00:09:50
This question already has an answer here: Can I parameterize the table name in a prepared statement? 2 answers In my mind I have a query that goes something like this: $sort = isset($sort) ? sanitize($_sort) : 'id'; if ($result = $link->prepare(" SELECT id, price FROM items ORDER BY ? ")) { $result->bind_param("s", $sort); $result->execute(); etc... } When I run this code block without setting the sort variable it runs without an error relating to the use of the ? in the ORDER BY clause and a result set is displayed in what appears to be a result set with "ORDER BY id". If I set the sort
订阅 bindparam