Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #5511

Clean PDO-MySQL Statement

Show all headers | View raw

Hi everyone,

I am using the PDO with MySQL for the first time and created a statement. Besides from individual input validation (which I always do), I would like to know, if you consider the following to be a clean statement:

That's what I figured from googled examples:

include ("pdoconnect.php");
$stmt = $dbh->prepare("SELECT firstname, name FROM telephonebook WHERE from_work = :workstatus ORDER BY :mywish ASC");
$stmt->bindParam(':workstatus', $n, PDO::PARAM_INT);
$stmt->bindParam(':mywish', $value, PDO::PARAM_STR);
$n = 1; $order = "firstname";
$stmt->execute();

echo "<u>".$stmt->rowCount()."</u>\r\n";
while ($row = $stmt->fetch())
  echo $row['firstname']."&nbsp;".$row['name']."<br>";
$stmt->closeCursor();
$dbh = null;


in pdoconnect.php:
-----------------------
try
  { $dbh = new PDO('mysql:host=host1.myhost.com;dbname=mydb1', alex, mypass);
    foreach ($dbh->query('SELECT * from FOO') as $row)
      { print_r($row); }
  }
    catch(PDOException $e)
      { print "Database connection error!<br/>";
        die();
      }

I tried to prevent SQL injection methods by specifying PDO::PARAM*, and closing the statement and connection properly.

Is this a correct example? Or should I improve something?

Any hints greatly appreciated, since I am about to change all my scripts to this :-)
Thanks, Alex

Back to comp.lang.php | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Clean PDO-MySQL Statement Alexandra Herzog <herzog.alex@arcor.de> - 2012-04-13 13:30 +0200
  Re: Clean PDO-MySQL Statement "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-04-13 14:42 +0200
  Re: Clean PDO-MySQL Statement Jerry Stuckle <jstucklex@attglobal.net> - 2012-04-13 12:07 -0400

csiph-web