prepared-statement

How to use prepared statements in queries with an IN clause in PHP [duplicate]

梦想的初衷 提交于 2019-12-10 14:09:08
问题 This question already has an answer here : Bind multiple parameters into mysqli query (1 answer) Closed 2 years ago . I need to make a simple query $array_of_ids = array(); //poulate $array_of_ids, they don't come from another db but from Facebook //so i can't use a subquery for the IN clause $wpdb->prepare("SELECT id from table where id IN (%d, %d)", $array_of_ids [0], $array_of_ids [1]); The question is, if i have 200 elements in the array, what is the correct way to handle this?Do i have

PDO queryString with binded data

霸气de小男生 提交于 2019-12-10 13:46:01
问题 If I have a prepared statement like SELECT * FROM users WHERE userid = :userid , i can read this SQL statement via PDOStatement::$queryString . For logging i want to have the string, which is executed, e.g. ... WHERE userid = 42 . How do i get this string? 回答1: PDOStatement->debugDumpParams is what you want. You may need to use output buffering though as the results are echoed out. 来源: https://stackoverflow.com/questions/6491711/pdo-querystring-with-binded-data

Is it possible to use GROUP BY with bind variables?

痞子三分冷 提交于 2019-12-10 13:38:10
问题 I want to issue a query like the following select max(col1), f(:1, col2) from t group by f(:1, col2) where :1 is a bind variable. Using PreparedStatement , if I say connection.prepareStatement ("select max(col1), f(?, col2) from t group by f(?, col2)") I get an error from the DBMS complaining that f(?, col2) is not a GROUP BY expression. How does one normally solve this in JDBC? 回答1: I suggest re-writing the statement so that there is only one bind argument. This approach is kind of ugly, but

PHP errors -> Warning: mysqli_stmt::execute(): Couldn't fetch mysqli_stmt | Warning: mysqli_stmt::close()

让人想犯罪 __ 提交于 2019-12-10 13:07:22
问题 I keep getting this error while trying to modify some tables. Here's my code: /** <- line 320 * * @param array $guests_array * @param array $tickets_array * @param integer $seat_count * @param integer $order_count * @param integer $guest_count */ private function book_guests($guests_array, $tickets_array, &$seat_count, &$order_count, &$guest_count){ /* @var $guests_array ArrayObject */ $sucess = false; if(sizeof($guests_array) >= 1){ //$this->mysqli->autocommit(FALSE); //insert the guests

PHP Select with PDO Call to a member function prepare() on a non-object error

╄→гoц情女王★ 提交于 2019-12-10 12:26:17
问题 I'm getting a Call to a member function prepare() on a non-object error in my PHP when using PDO to select data that was sent via an AJAX call. Searching around on StackOverflow I've found many answers to this error, but none work to fix my problem. The weird part is that the other PHP files use the same PDO calls and work successfully, but this one is giving me the non-object error only. To note, the PDO connection is identical to the other pages where it works, so I know that's not causing

Php pdo unixOBDC to sqlserver 2008: String data, length mismatch when execute prepared stmt

我是研究僧i 提交于 2019-12-10 12:20:04
问题 I have the following setup: Apache / php 5.3 / pdo with odbc with installed Microsoft SQL Server ODBC Driver 1.0 for Linux on server. My script rises an error with the following stacktrace when trying to execute a statement: (UTC) 2013-12-16 12:07:40: Thrown exception log -> 'Error message: SQLSTATE[22026]: String data, length mismatch: 0 [Microsoft][SQL Server Native Client 11.0]String data, length mismatch (SQLExecute[0] at /tmp/pear/temp/PDO_ODBC/odbc_stmt.c:133) Arisen in Core_Db->select

Fortify flagging query as sqlInjection when passing in parameters to a method

£可爱£侵袭症+ 提交于 2019-12-10 11:57:23
问题 We have a method in our database layer which looks like this: public List<String> getNamesFromId(List<Long> idsList){ StringBuilder query = new StringBuilder(); query.append("Select first_name from person where id in ("); for (int pos = 0; pos < idsList.size(); pos++) { query.append("?"); query.append(","); } query.deleteCharAt(query.length() - 1).append(")"); try { conn = establishConnection(); pstmt = conn.prepareStatement(query.toString()); for (int i = 0; i < selections.size(); i++) {

How to make dynamic postgres prepared statements in PHP

徘徊边缘 提交于 2019-12-10 11:55:14
问题 I'm trying to make some prepared statements in PHP using postgres. It's a bit difficult to explaing so i'll just show you: $stmt = "SELECT * FROM customer WHERE zip = '$1'"; if(isset($_POST["CITY"])){ $stmt .= "AND city = '$2'"; } if(isset($_POST["COUNTRY"])){ $stmt .= "AND country = '$3'"; } $result = pg_prepare("myconnection", "my query", $stmt); $result1 = pg_execute("myconnection","my query", array("0000","someCity","someCountry")); Sorry if some of the code is wrong but it's a freehand

Java PreparedStatement RETURN_GENERATED_KEYS not working

守給你的承諾、 提交于 2019-12-10 11:38:43
问题 I am trying to get the identity column returned to my java program when doing a SQL insert. I am getting the following error when running the code Uncaught exception thrown in one of the service methods of the servlet: Cocoon. Exception thrown : java.lang.AbstractMethodError: java/sql /Connection.prepareStatement(Ljava/lang/String;I)Ljava/sql/PreparedStatement; Here is the code I am running. private void insertUserInputParameters(ReportData rptData){ UserInputParameters userParams = rptData

When is quoting necessary in prepared statements of pdo in PHP?

会有一股神秘感。 提交于 2019-12-10 11:38:11
问题 It's from the comment under this answer,but I really don't figure out what he means: How to change from mysql to pdo using prepared statements in PHP? 回答1: When using prepared statements you never have to escape/quote a string parameter for the dbms (parser) manually. The comment relates to http://docs.php.net/pdo.prepared-statements: Prepared statements are so useful that they are the only feature that PDO will emulate for drivers that don't support them. I.e. if the driver doesn't support