How to add parameters to my query using sqlsrv in php? - php

Question

I am trying to pass a parameter to my query to filter by client (chosen through a dropdown list). I am aware of SQL injections and would like to avoid using the parameter in my query string. Is there a way I could pass my parameter to the query without having to risk an sql injection?
//Function creates a connection between a query and a db table.
function createQueryConn($query)
{
$GLOBALS['queryconn'] = sqlsrv_query($GLOBALS['conn'], $query, array(), array("Scrollable" => 'static'));
}
class CONNECTDB
{
// Creates connection to the database using sqlsrv.
public function dbConnection()
{
$servername = "bl3c7b";
$connectionInfo = array("Database" => "dashboard_das", "UID" => "test", "PWD" => "test",'ReturnDatesAsStrings'=>true);
$GLOBALS['conn'] = sqlsrv_connect($servername, $connectionInfo);
if (!$GLOBALS['conn']) {
echo "Error connecting to database.";
die(print_r(sqlsrv_errors(), true));
}
}
}
// Call DB connection.
$Connection = new CONNECTDB();
$Connection->dbConnection();
// Function gets activities per employee param.
function getActivityPerEmployee($employee)
{
$WoNum = $Status = null;
$query = "SELECT [WONUM],[STATUS] FROM [dbo].[Activities] act
WHERE YEAR(SCHEDSTART)=2019
AND
[STATUS] not like 'CLOSED'
AND
DATEDIFF(dd,SCHEDSTART,SCHEDFINISH) < 30
and OWNER like '$employee'
order by [OWNER] ASC";
createQueryConn($query);
$rows = sqlsrv_has_rows($GLOBALS['queryconn']);
if ($rows === false) {
} else {
while ($row = sqlsrv_fetch_array($GLOBALS['queryconn'], SQLSRV_FETCH_ASSOC)) {
ConvertData($row["WONUM"],$row["STATUS"]);
}}
}

Answer 1

PHP Driver for SQL Server supports the execution of parameterized queries by using sqlsrv_query() or sqlsrv_prepare() \ sqlsrv_execute() functions.
The sqlsrv_query function is well-suited for one-time queries and
should be the default choice to execute queries unless special
circumstances apply. This function provides a streamlined method to
execute a query with a minimum amount of code. The sqlsrv_query
function does both statement preparation and statement execution, and
can be used to execute parameterized queries.
...
The combination of
sqlsrv_prepare and sqlsrv_execute separates statement preparation and
statement execution in to two function calls and can be used to
execute parameterized queries. This function is ideal to execute a
statement multiple times with different parameter values for each
execution.
If you want to execute a parameterized query, follow the next steps:
Define a placeholders in the SQL statement using question marks (?).
Initialize an array of parameter values which correspond to parameter placeholders.
The following example is based on your code and demonstrates how to execute a parameterized query:
<php
...
function getActivityPerEmployee($employee)
{
$WoNum = $Status = null;
$query = "
SELECT [WONUM],[STATUS]
FROM [dbo].[Activities] act
WHERE
YEAR(SCHEDSTART)=2019 AND
[STATUS] not like 'CLOSED' AND
DATEDIFF(dd,SCHEDSTART,SCHEDFINISH) < 30 and
OWNER LIKE '%' + ? + '%'
-- or without LIKE
-- OWNER = ?
order by [OWNER] ASC
";
$GLOBALS['queryconn'] = sqlsrv_query(
$GLOBALS['conn'],
$query,
array($employee),
array("Scrollable" => 'static')
);
if ($GLOBALS['queryconn'] === false) {
echo "Error: ".print_r(sqlsrv_errors(), true);
exit;
}
$rows = sqlsrv_has_rows($GLOBALS['queryconn']);
if ($rows === false) {
} else {
while ($row = sqlsrv_fetch_array($GLOBALS['queryconn'], SQLSRV_FETCH_ASSOC)) {
// Your code here
}
}
}
...
?>