PDO is bindParam replaced?

[greenace92]

I'm not sure if I am missing something here, I've looked over a lot of threads regarding PDO and sql-injection prevention.

 

Do I need to use bindParam or does PDO do this?

 

This is an example from an entry:

<?php

$db->prepare('SELECT * FROM table WHERE foo = ?');
$db->execute(Array("content"));

?>

But there is no bindParam line? In my particular purpose, I am simply trying to insert data.

 

 

These are my insert attempts at the moment, most recent at the top. Right now it is not working but this is the thought that I have to use bindParam... I'm new to PDO so I'm trying to be certain that I get it right.

<?php

$link = new PDO("mysql:host=$dbhost;$dbname=$dbname",$dbusername,$dbpasswrod);

$statement = $link->prepare("INSERT INTO entries(id,date,views,relate,comments) VALUES(?, ?, ?)");
$statement->execute(array($id,$entry,$date,$views,$relate,$comments));

?>

<?php

$dbh = new PDO('mysql:host=localhost;dbname= ', ' ', ' ');
$sth = $dbh->prepare('INSERT INTO table VALUES (?,?,?,?,?,?)');
$sth->bind_param('issiii',$id,$entry,$date,$views,$relate,$comments);
$sth->execute();
$sth->closeCursor();
$sth = null;
$pdo = null;
sleep(60);

?>

I also ran across a problem about closing mysql/php process but I also read that after the script completes the connection is closed right away. So I'm wondering about that as well regarding the null and sleep lines.

 

Thanks for any help.

[Jacques1]

When you pass an array to the execute() method, then those elements will be bound to the parameters. That's simply how PDO works. It's also possible to explicitly bind variables/values to parameters using either PDOStatement::bindParam() or PDOStatement::bindValue(). The advantage of explicit binding is that you can declare the type of the value. By default, all values are passed as strings, which means MySQL has to cast them if they aren't actually strings. This works most of the time, but sometimes type casting has unexpected results.

[greenace92]

It seems that adding this at the bottom of the execute line makes the insertion process take at least 10 seconds or more. Not sure why that is.

$stmt->closeCursor();
$stmt = null;
$pdo = null;
sleep(60);

Currently this is what I have but it is not inserting any data, despite the submission going through without errors.

<?php

/** if(extension_loaded('pdo')) {
* echo "The PDO extension is loaded.";
* }
* else {
* echo "The PDO extension is not loaded.";
* }
* if(extension_loaded('pdo_mysql')) {
* echo "The PDO extension for mysql is loaded.";
* }
* else {
* echo "The PDO extension for mysql is not loaded.";
}**/

mysqli_report(MYSQLI_REPORT_ALL);
error_reporting(E_ALL);
error_reporting(-1);
ini_set('display_errors',true);

if($_SERVER['REQUEST_METHOD']=='POST') {

// error check
if (empty($_POST['entry'])) {

    $errors['entry']="You haven't written anything.";
    }
    else {
    $entry_received = $_POST['entry'];
    }
    
if(empty($errors)) {
    
// raw date
$dt = new DateTime();
$now = $dt->format("m-d-y h:i");

$id = '';
$entry = $entry_received;
$date = $now;
$views = 0;
$relate = 0;
$comments = 0;

// connection info
$dbusername = " ";
$dbpassword = " ";

$link = new PDO('mysql:host=localhost;dbname=db',$dbusername,$dbpassword);

$stmt = $link->prepare("INSERT INTO entries(id,entry,date,views,relate,comments) VALUES(:id, :entry, :date, :views, :relate, :comments)");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->bindParam(':entry', $entry, PDO::PARAM_STR);
$stmt->bindParam(':date', $date, PDO::PARAM_STR);
$stmt->bindParam(':views', $views, PDO::PARAM_INT);
$stmt->bindParam(':relate', $relate, PDO::PARAM_INT);
$stmt->bindParam(':comments', $comments, PDO::PARAM_INT);
$stmt->execute();
}
}

?>

missed entry in entries(id...

Edited November 18, 2015 by greenace92

[greenace92]

When you pass an array to the execute() method, then those elements will be bound to the parameters. That's simply how PDO works. It's also possible to explicitly bind variables/values to parameters using either PDOStatement::bindParam() or PDOStatement::bindValue(). The advantage of explicit binding is that you can declare the type of the value. By default, all values are passed as strings, which means MySQL has to cast them if they aren't actually strings. This works most of the time, but sometimes type casting has unexpected results.

 

Thanks for the information Jacques1

[greenace92]

Nevermind, it works, I missed a column

[Jacques1]

Don't copy-and-paste random code snippets you found somewhere on Internet. Using sleep(60) causes the script to hang for a entire minute (or triggers a timeout), which is something you certainly don't want in a web application, neither during development nor in production.

[greenace92]

Caught red handed haha.

 

I get that.

 

Know what you are doing.