Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5519

Re: Clean PDO-MySQL Statement

Show all headers | View raw

On 4/13/2012 7:30 AM, Alexandra Herzog wrote:
> Hi everyone,
>
> I am using the PDO with MySQL for the first time and created a statement. Besides from individual input validation (which I always do), I would like to know, if you consider the following to be a clean statement:
>
> That's what I figured from googled examples:
>
> include ("pdoconnect.php");
> $stmt = $dbh->prepare("SELECT firstname, name FROM telephonebook WHERE from_work = :workstatus ORDER BY :mywish ASC");
> $stmt->bindParam(':workstatus', $n, PDO::PARAM_INT);
> $stmt->bindParam(':mywish', $value, PDO::PARAM_STR);
> $n = 1; $order = "firstname";
> $stmt->execute();
>
> echo "<u>".$stmt->rowCount()."</u>\r\n";
> while ($row = $stmt->fetch())
>    echo $row['firstname']."&nbsp;".$row['name']."<br>";
> $stmt->closeCursor();
> $dbh = null;
>
>
> in pdoconnect.php:
> -----------------------
> try
>    { $dbh = new PDO('mysql:host=host1.myhost.com;dbname=mydb1', alex, mypass);
>      foreach ($dbh->query('SELECT * from FOO') as $row)
>        { print_r($row); }
>    }
>      catch(PDOException $e)
>        { print "Database connection error!<br/>";
>          die();
>        }
>
> I tried to prevent SQL injection methods by specifying PDO::PARAM*, and closing the statement and connection properly.
>
> Is this a correct example? Or should I improve something?
>
> Any hints greatly appreciated, since I am about to change all my scripts to this :-)
> Thanks, Alex

No, it will not work.  You cannot use a bind parameter as a column name 
(i.e. in the ORDER BY clause).  You can only use it where you have a value.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Clean PDO-MySQL Statement Alexandra Herzog <herzog.alex@arcor.de> - 2012-04-13 13:30 +0200
  Re: Clean PDO-MySQL Statement "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-13 14:42 +0200
  Re: Clean PDO-MySQL Statement Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-13 12:07 -0400

csiph-web