PHP PDO Login script error

[goldensche]

Hi, I have modified my code for sql injection prevention and it does not work anymore. could someone tell me what i'm doing wrong here. thank you

 

previous code before the modification.

 

class DB_Functions {

 

    private $db;

 

    function __construct() {

   

        require_once 'db_connect.php';

       

        $this->db = new DB_Connect();

        $this->db->connect();

    }

 

    public function getUser($uid, $password) {

        $result = mysql_query("SELECT * FROM users WHERE id = '$uid' AND pswd = '$password'") or die(mysql_error());

       

        $no_of_rows = mysql_num_rows($result);

        if ($no_of_rows > 0) {

                 

            $result = mysql_fetch_array($result);

            return $result;   

   

        } else {

         

            return false;

        }

    }

 

 

updated code with error: "Call to undefined method DB_Connect::prepare() .."

 

class DB_Functions {

 

    private $db;

 

    function __construct() {

   

        require_once 'db_connect.php';

       

        $this->db = new DB_Connect();

        $this->db->connect();

    }

 

public function getUser($uid, $password) {

    $stmt = $this->db->prepare("SELECT * FROM users WHERE id=? AND pswd=?");

    $stmt->execute(array($uid, $password));

    return $stmt->fetch();

}

[goldensche]

 

 

previous code before the modification.

 

class DB_Functions {

    private $db;

    function __construct() {
    	
        require_once 'db_connect.php';
        
        $this->db = new DB_Connect();
        $this->db->connect();
    }

    public function getUser($uid, $password) {
        $result = mysql_query("SELECT * FROM users WHERE id = '$uid' AND pswd = '$password'") or die(mysql_error());
        
        $no_of_rows = mysql_num_rows($result);
        if ($no_of_rows > 0) {
                   
            $result = mysql_fetch_array($result);
            return $result;    
    
        } else {
           
            return false;
        }
    }

 

 

updated code with error: "Call to undefined method DB_Connect::prepare() .."

 

class DB_Functions {

    private $db;

    function __construct() {
    	
        require_once 'db_connect.php';
        
        $this->db = new DB_Connect();
        $this->db->connect();
    }

public function getUser($uid, $password) {
    $stmt = $this->db->prepare("SELECT * FROM users WHERE id=? AND pswd=?");
    $stmt->execute(array($uid, $password));
    return $stmt->fetch();
}

[Christian F.]

I think you need to re-check the PHP manual, as your mistake is quite basic.

[goldensche]

Thank you for your comment. Yes I am very new to php and programming.. I'm learning. and it takes longer for someone really old like me.