PDOStatement::execute() expects parameter 1 to be array, bool given - php

Question

When I want to update my articles table from MySQL database I get the following error
PDOStatement::execute() expects parameter 1 to be array, bool given in /Users/Iceson/Sites/blog jean/app/Database.php on line 49
Here the update code from my managementpost.php
if(isset($_POST['update'])) {
$id = $_POST['id'];
$titre = $_POST['titre'];
$contenu = $_POST['contenu'];
App\App::getDb()->prepare("UPDATE articles SET titre ='$titre',
contenu ='$contenu' WHERE id='id'",true);
}
Here is the my database class from my database.php, the error is located on the line $req->execute($attributes); in the function prepare
<?php
namespace App;
use \PDO;
class Database {
private $db_name;
private $db_user;
private $db_pass;
private $db_host;
private $pdo;
public function __construct($db_name, $db_user = 'root', $db_pass = 'root', $db_host = 'localhost') {
$this->db_name = $db_name;
$this->db_user = $db_user;
$this->db_pass = $db_pass;
$this->db_host = $db_host;
}
private function getPDO() {
if ($this->pdo === null) {
$pdo = new PDO('mysql:host=localhost;dbname=blogdejean;charset=utf8', 'root', 'root');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$this->pdo = $pdo;
}
return $this->pdo;
}
public function query($statement, $class_name = null, $one = false) {
$req = $this->getPDO()->query($statement);
if($class_name === null) {
$req->setFetchMode(PDO::FETCH_OBJ);
} else {
$req->setFetchMode(PDO::FETCH_CLASS, $class_name);
}
if($one) {
$datas = $req->fetch();
} else {
$datas = $req->fetchALL();
}
return $datas;
}
public function prepare($statement, $attributes, $class_name = null, $one = false) {
$req = $this->getPDO()->prepare($statement);
$req->execute($attributes);
if($class_name === null) {
$req->setFetchMode(PDO::FETCH_OBJ);
} else {
$req->setFetchMode(PDO::FETCH_CLASS, $class_name);
}
if($one) {
$datas = $req->fetch();
} else {
$datas = $req->fetchALL();
}
return $datas;
}
}

Answer 1

You are using your database class wrong: Instead of sending a statement with parameters you can bind, you inject the values in the sql statement making your query vulnerable to sql injection.
And where you need to send an array of values to bind, you send a boolean.
So you need to replace this:
App\App::getDb()->prepare("UPDATE articles SET titre ='$titre', contenu ='$contenu' WHERE id='id'",true);
with:
App\App::getDb()->prepare(
"UPDATE articles SET titre = ?, contenu = ? WHERE id = ?",
[
$_POST['titre'],
$_POST['contenu'],
$_POST['id'],
]
);
You should probably also re-think why you are extending PDO like that; fetching all rows does not make sense on an update statement for example.

Answer 2

thanks y'all now i have a general error "General error in /Users/Iceson/Sites/blog jean/app/Database.php:58" it's the $datas = $req->fetchALL(); i think i messed up my database class everything was working until the update part, i don't know what's wrong

Answer 3

public function prepare($statement, $attributes, $class_name = null, $one = false) {
$req = $this->getPDO()->prepare($statement);
$req->execute($attributes);
if($class_name === null) {
$req->setFetchMode(PDO::FETCH_OBJ);
} else {
$req->setFetchMode(PDO::FETCH_CLASS, $class_name);
}
if($one) {
$datas = $req->fetch();
} else {
$datas = $req->fetchALL();
}
return $datas;
}
You prepare method expects a array as the second argument ($attributes), but you passed it true.
App\App::getDb()->prepare("UPDATE articles SET titre ='$titre', contenu ='$contenu' WHERE id='id'",true);
It should be something like this.
App\App::getDb()->prepare("UPDATE articles SET titre = :titre, contenu = :contenu WHERE id= :id",[':titre' => $titre, ':contenu' => $contenu, ':id' => $id ]);