PDO general error when using fetch after insert - php

I'm trying to fetch data from the db using fetchAll(), which works unless I try to do so right after an insert query. The error I keep getting is a "General error". I read online that this is a know issue:
It seems that if you do a $statement->query() with an INSERT statement and after that a $statement->fetch() you will get an exception saying: SQLSTATE[HY000]: General error. source
Is there any way to go around this?
My code
First I'm running an insert query:
INSERT INTO question (`qid`, `question`, `category`, `subcategory`, `explanation`, `answer_type`, `answer_options`, `answer_nav`, `answer_optional`) VALUES ('65', 'TEST', 'wisselvraag', 'wk 1 - wk 1', '<strong>Let op! Maak aantekening bij vraag.</strong>', 'yes_no', '{null,null}', '', '1')
private function get($columns = "*", $dump = false)
{
$this->select($columns);
$this->prepareSQL();
if ($dump === true) {
$this->dumpSQL();
return [];
}
$this->stmt = $this->getPdo()->prepare($this->query);
$this->stmt->execute();
$this->incrementAmountOfQueries();
return $this->stmt->fetchAll(\PDO::FETCH_ASSOC);
}
Right after doing that I run a SELECT query:
SELECT question.* FROM question JOIN questionlist_question ON questionlist_question.`question_id` = question.`id` WHERE question.`category` = 'wisselvraag' AND questionlist_question.`questionlist_id` = '7' ORDER BY question.`qid` DESC LIMIT 1
To
$this->stmt->execute();
$this->stmt->fetchAll(\PDO::FETCH_ASSOC);
My data. The fetchAll() seems to be the problem.
/**
* prepare an INSERT query
* #param array $data
* #return bool
*/
private function insert(Array $data)
{
$fields = "";
$values = "";
foreach ($data as $field => $value) {
$value = htmlentities($value);
$fields .= "`$field`, ";
$values .= "'$value', ";
}
$fields = trim($fields, ", ");
$values = trim($values, ", ");
$this->insert = "($fields) VALUES ($values)";
$this->incrementAmountOfQueries();
return $this->execute();
}
/**
* Execute a query
* #return bool
*/
private function execute()
{
$this->prepareSQL();
// print($this->query);
// exit;
$this->stmt = $this->getPdo()->prepare($this->query);
return $this->stmt->execute();
}
$This->stmt
$this->stmt is defined as $this->stmt = $this->getPdo()->prepare($this->query);
getPdo()
/**
* Get PDO instance
* #return \PDO
*/
private function getPdo()
{
if (!$this->pdo) {
try {
$this->pdo = new \PDO($this->dsn, $this->username, $this->password);
$this->pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
} catch (\Exception $err) {
print_r($err);
exit;
}
}
return $this->pdo;
}
$this->query
private function prepareSQL()
{
$sql = "";
if ($this->insert) {
if ($this->table) {
$sql .= "INSERT INTO " . $this->table;
$sql .= " " . $this->insert;
}
} else {
if ($this->select) $sql .= "SELECT " . $this->select;
if ($this->table) $sql .= " FROM " . $this->table;
if ($this->join) $sql .= " " . $this->join;
if ($this->where) $sql .= " " . $this->where;
if ($this->order) $sql .= " " . $this->order;
if ($this->limit) $sql .= " LIMIT " . $this->limit;
}
$this->query = $sql;
return $this;
}

Yes.
I suppose you are returning this value from a function. Well, return a statement instead. And then chain a fetchAll() to your function call later, if you need to get the rows. You won't believe how enormously flexible your function will become.
You can check an example section for this kind of function: all this stuff is available only thanks to a statement returned.
You may also would like to read my other article, Your first database wrapper's childhood diseases as I am sure your wrapper has other issues.

Related

PHP/MySQL - How to delete insert if query fails?

I have this code
<?php
class Objekt{
// database connection and table name
private $conn;
private $table_name = "objects";
// object properties
public $id;
public $id_group;
public $title;
public $description;
public $lat;
public $lng;
public $icon;
public $tagsraw;
// constructor with $db as database connection
public function __construct($db){
$this->conn = $db;
}
function create(){
// query to insert record
$query = "INSERT INTO
" . $this->table_name . "
SET
id_group=:id_group, title=:title, description=:description, lat=:lat, lng=:lng, icon=:icon;
SELECT max(id) AS id FROM objects;";
// prepare query
$stmt = $this->conn->prepare($query);
// sanitize
$this->id_group=htmlspecialchars(strip_tags($this->id_group));
$this->title=htmlspecialchars(strip_tags($this->title));
$this->description=htmlspecialchars(strip_tags($this->description));
$this->lat=htmlspecialchars(strip_tags($this->lat));
$this->lng=htmlspecialchars(strip_tags($this->lng));
$this->icon=htmlspecialchars(strip_tags($this->icon));
// bind values
$stmt->bindParam(":id_group", $this->id_group);
$stmt->bindParam(":title", $this->title);
$stmt->bindParam(":description", $this->description);
$stmt->bindParam(":lat", $this->lat);
$stmt->bindParam(":lng", $this->lng);
$stmt->bindParam(":icon", $this->icon);
// execute query
if($stmt->execute()){
//$stmt->execute();
/*
ERROR below here
Uncaught PDOException: SQLSTATE[HY000]: General error
stack trace:
#0 PDOStatement ->fetch(2)
#1 Objekt->create()
*/
$result = $stmt->fetch(PDO::FETCH_ASSOC);
$this->id = $result['id'];
echo "$this->id";
//get tags matches
$tags = [];
$this->tagsraw = preg_replace('/\s+/', '', $this->tagsraw);
$tags = explode(',', $this->tagsraw);
$id_tags = [];
for ($i = 0; $i < sizeof($tags); $i++) {
$query = "SELECT id FROM category WHERE title=" . tags[i];
$stmt = $this->conn->prepare($query);
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_OBJ);
$id_tags[i] = $result->id;
}
for ($i = 0; $i < sizeof($id_tags); $i++) {
$query = "INSERT INTO category_object SET id_object=" . $this->id . ", id_category=" . $id_tags[i];
$stmt = $this->conn->prepare($query);
$stmt->execute();
}
return true;
}
return false;
}
What I want to do:
Insert Object and create a relation to a category_object table over foreign keys id_object / id_category
What I would like to improve:
What do I have to do to delete an insert if it fails (where should I put a try/catch or something else)
What is wrong with my fetch? I Select the value from max(id) to get the value of my inserted object, why is it throwing an Exception
I have another Warning why is it telling me that
for ($i = 0; $i < sizeof($id_tags); $i++) {
$query = "INSERT INTO category_object SET id_object=" . $this->id . ", id_category=" . $id_tags[i];
$stmt = $this->conn->prepare($query);
$stmt->execute();
}
will be deprecated in future php versions..
Use transactions.
Any insert/update/delete done within a transaction will not be actually executed against the database until you call commit(), and you can always roll back the changes, abandoning them in case of failure.
In your code, you should be OK with replacing if($stmt->execute()){ with
try {
$this->conn->beginTransaction();
$stmt->execute();
// ...everything else from inside the if statement here...
$this->conn->commit();
return true;
} catch (\Exception $e) {
$this->conn->rollback();
return false;
}

Mysqli connection using object

I just started switching my project form the mysql to mysqli. So what i did is i just create a class db and function connect.how can i create objects and re use it
This is my code:
class db:
class db {
//global var session
private $biz;
//constructor
function db (&$b) {
$this->biz = $b;
$this->connect();
}
function connect() {
mysqli_connect(
$this->biz->_db['host']
, $this->biz->_db['username']
, $this->biz->_db['password']
,$this->biz->_db['database']
) or die("Unable to connect to database");
//$cont=mysqli_select_db($con,$this->biz->_db['database']) or die("Unable to select database: {$this->biz->_db['database']}");
//return $connt;
}
/*
This function will perform a simple query and return all the results
#return object Object containing the rows, num_rows and result
#param string $sql The SQL query
*/
function query($sql) {
$result = new fetchQuery($sql);
return $result;
}
/*
This function will perform a query given the sql
#return object Object containing num rows affected and result
#param string $sql The SQL query
*/
function updateQuery($sql) {
return new updateQuery($sql);
}
/*
This function will perform a query given the sql
#return object Object containing num rows affected and result
#param string $sql The SQL query
*/
function insertQuery($sql) {
return new insertQuery($sql);
}
/*
This function will perform a query given the sql
#return object Object containing num rows affected and result
#param string $sql The SQL query
*/
function deleteQuery($sql) {
return new deleteQuery($sql);
}
/*
This function will automatically decide if data is being updated or inserted
#param array $data The post object, key/value pairs , already validated
#param string $table The table to be updated
*/
/*
This function will perform an update query from the post data that has the correct form - fields matching table field names
#return object Object containing num rows affected and result
#param array $data The post object, key/value pairs , already validated
#param string $table The table to be updated
*/
function autoUpdate($data, $table,$wheredata) {
//id is required, return false if not found
if (!isset($wheredata))
{
return false;
}
$sql = "
UPDATE
`$table`
SET
";
foreach ($data as $key => $value) {
$sql .= " `$key` = '$value' ,";
}
//remove extra comma
$sql = substr($sql, 0, (strlen($sql) - 1));
$sql .= " WHERE 0=0 ";
foreach ($wheredata as $key => $value) {
$sql .= " and `$key` = '$value' ";
}
return new updateQuery($sql);
}
/*
This function will perform an insert query from the matching form table
#return object Object containing num rows affected and result
#param array $data The post object, key/value pairs , already validated
#param string $table The table to be updated
*/
function autoInsert($data, $table, $validate = false)
{
$_fields = array();
$_values = array();
foreach ($data as $field => $value) {
$_fields[] = $field;
$_values[] = $value;
}
$sql = "
INSERT INTO
`$table`
(
";
foreach($_fields as $field) {
$sql .= "`$field` ,";
}
//remove extra comma
$sql = substr($sql, 0, (strlen($sql) - 1));
$sql .= "
) VALUES (
";
foreach($_values as $value) {
$sql .= "'$value' ,";
}
//remove extra comma
$sql = substr($sql, 0, (strlen($sql) - 1));
$sql .= "
)
";
return new insertQuery($sql);
}
/*
This function will perform an auto delete query from the matching form table
#return object Object containing num rows affected and result
#param int $id The related id
#param string $table The table to be affected
*/
function autoDelete($sql) {
return new deleteQuery($sql); }
}
fetch query:
class fetchQuery {
public $result;
public $num = 0;
public $rows = array();
public $error = false;
function fetchQuery($sql) {
$this->result = mysql_query($sql);
if ($this->result) {
$this->num = mysql_num_rows($this->result);
if ($this->num) {
while($row = mysql_fetch_assoc($this->result)) {
$this->rows[] = $row;
}
} else {
$this->result = false;
}
} else {
$this->result = false;
$this->error = mysql_error();
}
}
please give me a solution for create fetch query using connect function.
Make a structure like below and try
Database Configuration : dbconfig.php
<?php
$glob['dbhost'] = 'localhost';
$glob['dbusername'] = 'username';
$glob['dbpassword'] = 'password';
$glob['dbdatabase'] = 'database';
?>
Database Class : database.class.php
<?php
class database {
var $_sql = '';
/** #var Internal variable to hold the connector resource */
var $_resource = '';
/** #var Internal variable to hold the query result*/
var $_result = '';
/**
* Database object constructor
* #param string Database host
* #param string Database user name
* #param string Database user password
* #param string Database name
*/
function database() {
global $glob;
$host = $glob['dbhost'];
$user = $glob['dbusername'];
$pass = $glob['dbpassword'];
$db = $glob['dbdatabase'];
$this->_resource = #mysqli_connect( $host, $user, $pass, $db );
if (mysqli_connect_errno()){
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
else{
echo "Could not connect to the database!";
exit;
}
}
/**
* Execute the query
* #return mixed A database resource if successful, FALSE if not.
*/
function query($sql) {
$_sql = $sql;
return $_result = #mysqli_query($this->_resource, $_sql);
}
function fetchArray($result) {
return #mysqli_fetch_array($result);
}
function fetchAssoc($result) {
return #mysqli_fetch_assoc($result);
}
}
?>
Project Configuration : configuration.php
<?php
session_start();
ob_start("ob_gzhandler");
#ob_gzhandler();
error_reporting(E_ERROR);
require_once('dbconfig.php');
require_once('database.class.php');
$dbclass = new database();
?>
Any project file code :
<?php
require('configuration.php');
$sqltepm="SELECT * FROM tblname";
$restepm=$dbclass->query($sqltepm);
while($row=$dbclass->fetchArray($restepm)){
extract($row);
}
?>
You can create a basic function like strategy to handle this type of Scenario. Hence if you include the function file alone your DB will be connected on the fly and you can use this using the variable that you connect to the DB.
You can have two files and then you can perform the scenario like this.
db.php
<?php
class DB {
function __construct(){
$username='root';
$password='';
$host='localhost';
$db='store';
$this->connection = mysqli_connect($username,$password,$host,$db);
if(mysqli_connect_errno){
echo "Failed to connect to MYSQL: " . mysqli_connect_error();
}
}
function fetchData(){
$get_query = "SELECT * FROM TABLE"
$result = mysqli_query($this->connection, $get_query);
}
}
?>
And you can call the function in the page as follows.
Usage of the class that we have created
listpage.php
<?php
include('db.php'); // Include the DB file over this line
$conn= new DB(); // Initialize the class that we have created
$conn->fetchData();// This query will select all the data and return it.
?>
I hope so my explanation over the code are clear and you can understand it well and continue your project codes on the fly.
Happy Coding :)

PHP file cannot enter some part of code

Here is a function in my php file, which is used to serve the request of my android app.
function checkin($DB, $TechID, $ClientID, $SiteID){
$dbConnection = mysql_connect($DB['server'], $DB['loginName'], $DB['password']);
if(!$dbConnection){
die('Error! ' . mysql_error());
}
mysql_select_db($DB['database'], $dbConnection);
$file2 = "C:/wamp/www/file2.txt";
$data2 = "ClientID:".$ClientID." TechID:".$TechID." SiteID:".$SiteID;
file_put_contents($file2, $data2);
$result1 = mysql_query("SELECT COUNT(*) FROM Log") or die('Error! ' . mysql_error());
$query = "SELECT `Type` FROM `Log` WHERE `TechID` = '".$TechID."' ORDER BY LogTime DESC LIMIT 1";
$file5 = "C:/wamp/www/file5.txt";
file_put_contents($file5, $query);
$result2 = mysql_query($query) or die('Error! ' . mysql_error());
while($row1 = mysql_fetch_array($result1)){
$count = $row1['COUNT(*)'];
$file3 = "C:/wamp/www/file3.txt";
$data3 = "ClientID:".$ClientID." TechID:".$TechID." SiteID:".$SiteID." Count:".$count;
file_put_contents($file3, $data3);
while($row2 = mysql_fetch_array($result2)){
$file4 = "C:/wamp/www/file4.txt";
$data3 = "ClientID:".$ClientID." TechID:".$TechID." SiteID:".$SiteID." Count:".$count;
file_put_contents($file4, $data3);
/*if($row2['Type']!="Checkin"){
$count = $count+1;
$Time = date('Y/m/d H:i');
mysql_query("INSERT INTO Log (LogID, TechID, ClientID, SiteID, LogTime, Type)
VALUES (".$count.", ".$TechID.", ".$ClientID.", ".$SiteID.", ".$Time.", Checkin)");
}else{
$query2 = "SELECT TechEmail FROM Tech WHERE TechID=".$TechID;
$result3 = mysql_query($query2) or die('Error! ' . mysql_error());
$subject = "Please check out";
$message = "You have forgot to logout from the last site, please check out manually";
$from = "devadmin#uniserveit.com";
$header = "Form:".$from;
while($row3 = mysql_fetch_array($result3)){
mail($row3['TechEmail'], $subject, $message, $header);
}
}*/
}
}
}
you can see that I have hidden some codes, since I am debugging it, I create some files just to see which part of codes cannot be executed. I discover that the program cannot enter the region where file4 should be created. I have seeked out probably the problem is coming from the $query, when it executes, somethimes the mysql will response "unknown table status: TABLE_TYPE", which I cannot understand why.
As written in the comment above, you should divide and conquer to make your life easier (especially as you write the code while you play around with it in that large function). That does work as easy as:
function file_put($number, $data)
{
$path = sprintf("C:/temp/wamp/www/file%d.txt", $number);
file_put_contents($path, $data);
}
for example that is just replacing the many duplicate lines where you just need a (numbered) file you put some string in.
But you can also do this with more complex stuff, like the database operation. You probably want to move the error handling out of your sight as well as taking care to connect to the database when needed and a more flexible way to fetch the data. That can be done by moving the (softly deprecated) mysql_* functions into one or two classes of its' own, so that it gets out of your sight. That will make it's usage much more easier (which I show first):
// Create your database object to use it later on:
$config = array(
'server' => 'localhost',
'name' => 'root',
'password' => '',
'db' => 'test',
);
$db = new MySql($config);
I called the database class MySql as it represents the mysql connection and it works with the old mysql extension. You only need to pass that database object then into the function in your question. Combined with the file_put function, it would look like this:
function checkin(MySql $DB, $TechID, $ClientID, $SiteID)
{
$query = sprintf("SELECT `Type` FROM `Log` WHERE `TechID` = '%d' ORDER BY LogTime DESC LIMIT 1", $TechID);
file_put(5, $query);
$result1 = $DB->query("SELECT COUNT(*) FROM Log");
$result2 = $DB->query($query);
foreach ($result1 as $row1) {
list($count) = $row1;
$data = "ClientID:$ClientID TechID:$TechID SiteID:$SiteID Count:$count"
file_put(3, $data);
foreach ($result2 as $row2) {
file_put(4, $data);
}
}
}
Still the checkin function is close to being large (12 lines of code already), but is much shorter than your first version because it delegates the work for writing the files and accessing the database. I hope this demonstration is useful. What follows is the full code example:
/**
* MySql Exception
*/
class MySqlException extends RuntimeException
{
}
/**
* MySql Database Class
*/
class MySql
{
private $server;
private $name;
private $password;
private $db;
private $connection;
public function __construct(array $config)
{
$this->server = $config['server'];
$this->name = $config['name'];
$this->password = $config['password'];
$this->db = $config['db'];
}
private function connect($server, $name, $password)
{
$this->connection = mysql_connect($server, $name, $password);
if (!$this->connection) {
$this->error("Unable to connect to '%s' as user '%s'", $server, $name);
}
}
private function select($db)
{
if (!mysql_select_db($db, $this->connection)) {
$this->error("Unable to select database '%s'", $db);
}
}
private function close()
{
$this->connection && mysql_close($this->connection);
}
private function connectSelect()
{
$this->connect($this->server, $this->name, $this->password);
$this->select($this->db);
}
/**
* #param $query
* #return MySqlResult
*/
public function query($query)
{
$this->connection || $this->connectSelect();
$result = mysql_query($query, $this->connection);
if (!$result) {
$this->error("Unable to execute query '%s'", $query);
}
return new MySqlResult($result);
}
/**
* #param string $format
* #param ...
* #throws MySqlException
*/
private function error($format)
{
$args = func_get_args();
array_shift($args);
$format .= ': %s';
$args[] = $this->connection ? mysql_error($this->connection) : mysql_error();
throw new MySqlException(vsprintf($format, $args));
}
public function __destruct()
{
$this->close();
}
}
/**
* MySql Result Set - Array Based
*/
class MySqlResult implements Iterator, Countable
{
private $result;
private $index = 0;
private $current;
public function __construct($result)
{
$this->result = $result;
}
public function fetch($result_type = MYSQL_BOTH)
{
$this->current = mysql_fetch_array($this->result, $result_type);
return $this->current;
}
/**
* Return the current element
* #link http://php.net/manual/en/iterator.current.php
* #return array
*/
public function current()
{
return $this->current;
}
public function next()
{
$this->current && $this->fetch();
}
/**
* Return the key of the current element
* #link http://php.net/manual/en/iterator.key.php
* #return mixed scalar on success, or null on failure.
*/
public function key()
{
return $this->current ? $this->index : null;
}
/**
* Checks if current position is valid
* #link http://php.net/manual/en/iterator.valid.php
* #return boolean The return value will be casted to boolean and then evaluated.
* Returns true on success or false on failure.
*/
public function valid()
{
return (bool)$this->current;
}
/**
* Rewind the Iterator to the first element
* #link http://php.net/manual/en/iterator.rewind.php
* #return void Any returned value is ignored.
*/
public function rewind()
{
$this->fetch();
}
/**
* Count of rows.
*
* #link http://php.net/manual/en/countable.count.php
* #return int The count of rows as an integer.
*/
public function count()
{
return mysql_num_rows($this->result);
}
}
// Create your database object to use it later on:
$config = array(
'server' => 'localhost',
'name' => 'root',
'password' => '',
'db' => 'test',
);
$db = new MySql($config);
function file_put($number, $data)
{
$path = sprintf("C:/temp/wamp/www/file%d.txt", $number);
file_put_contents($path, $data);
}
function checkin(MySql $DB, $TechID, $ClientID, $SiteID)
{
$query = sprintf("SELECT `Type` FROM `Log` WHERE `TechID` = '%d' ORDER BY LogTime DESC LIMIT 1", $TechID);
file_put(5, $query);
$result1 = $DB->query("SELECT COUNT(*) FROM Log");
$result2 = $DB->query($query);
foreach ($result1 as $row1) {
list($count) = $row1;
$data = "ClientID:$ClientID TechID:$TechID SiteID:$SiteID Count:$count";
file_put(3, $data);
foreach ($result2 as $row2) {
file_put(4, $data);
}
}
}
checkin($db, 1, 2, 3, 4);
The simple answer should be:
mysql_query("INSERT INTO Log (LogID, TechID, ClientID, SiteID, LogTime, Type)
VALUES (".$count.", ".$TechID.", ".$ClientID.", ".$SiteID.", ".$Time.", Checkin)");
remove the quotes from the $vars. or single quote them. Also remove dots. Like:
mysql_query("INSERT INTO Log (LogID, TechID, ClientID, SiteID, LogTime, Type)
VALUES ('$count', '$TechID', '$ClientID', '$SiteID', '$Time', Checkin)");

How do you perform a dynamic php, PDO prepared statement Update?

I'm having trouble finding good documentation on pdo update prepared statements and even more trouble finding documentation on dynamically updating the database with pdo prepared statements. I've gotten my dynamic insert to work but am having trouble with the update. The error I'm getting is:
Warning: PDOStatement::execute() [pdostatement.execute]:
SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
in
/Users/scottmcpherson/Sites/phpsites/projectx/application/models/db.php
on line 91 error
Here is the class I created minus a couple of methods that are irrelevant to this problem:
<?php
require_once("../config/main.php");
class Database{
protected static $dbFields = array('username', 'password');
public $db;
public $tableName = 'users';
public $id = 1;
public $username = "Jonny";
public $password = "Appleseed";
public function __construct() {
$this->connect();
}
public function connect(){
try {
$this->db = new PDO("mysql:host=".DB_SERVER."; dbname=".DB_NAME, DB_USER, DB_PASS);
} catch (PDOException $e) {
echo 'Connection failed: ' . $e->getMessage();
}
}
public function properties() {
$properties = array();
foreach (self::$dbFields as $field) {
if (isset($this->field) || property_exists($this, $field)) {
$properties[$field] = $this->$field;
}
}
return $properties;
}
public function propertyValues() {
$property = $this->properties();
$propertyValues = array();
foreach ($property as $key => $value) {
$propertyValues = ":" . implode(", :", array_keys($property));
}
return $propertyValues;
}
public function polishedVals(){
// The end result of this function is:
// username=:username, password=:password
$props = $this->properties();
$phaseOne = array();
foreach ($props as $key => $value) {
$phaseOne[$key] = ":".$key;
}
$phaseTwo = array();
foreach ($phaseOne as $key => $value) {
$phaseTwo[] = "{$key}={$value}";
}
$polishedVals = implode(", ", $phaseTwo);
return $polishedVals;
}
public function update(){
$stmt = "UPDATE ". $this->tableName." SET ";
$stmt .= $this->polishedVals();
$stmt .= "WHERE id=" . $this->id;
$stmt = $this->db->prepare($stmt);
if($stmt->execute($this->properties())) {
echo "yes";
} else {
echo "error ";
}
}
}
$database = new Database();
echo$database->update();
?>
With all the variables replaced with the actual values, the result I'm going for with the update() method would look like this:
public function update(){
$stmt = "UPDATE users SET ";
$stmt .= "username=:username, password=:password ";
$stmt .= "WHERE id=1";
$stmt = $this->db->prepare($stmt);
if($stmt->execute($this->properties())) {
echo "yes";
} else {
echo "error ";
}
}
In addition to spotting this problem, please let me know if you see any other issues with this code. I'm still kind of new to PHP.
Edit: I've now created a new method that adds a : to the beginning of each key in the properties array:
public function colProperties(){
$properties = $this->properties();
$withCols = array();
foreach($properties as $key => $value){
$withCols[":".$key] = $value;
}
return $withCols;
}
So my update() method now looks like:
public function update(){
$stmt = "UPDATE ". $this->tableName." SET ";
$stmt .= $this->polishedVals();
$stmt .= "WHERE id=" . $this->id;
$stmt = $this->db->prepare($stmt);
if($stmt->execute($this->colProperties())) {
echo "yes";
} else {
echo "error ";
}
}
and if I var_dump($this->colProperties) I get:
array(2) { [":username"]=> string(5) "Jonny" [":password"]=> string(9) "Appleseed" }
And still getting the same error.
I don't think that passing parameters to an UPDATE query requires a different method than a SELECT one. The information in the PDOStatement->execute() manual page should apply:
<?php
/* Execute a prepared statement by passing an array of insert values */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < :calories AND colour = :colour');
$sth->execute(array(':calories' => $calories, ':colour' => $colour));
?>
You are using named parameters so execute() expects an associative array. Use var_dump() to display $this->properties() right before execute():
var_dump($this->properties())
Make sure you keys match exactly.
The error is that in between
$stmt .= $this->polishedVals();
$stmt .= "WHERE id=" . $this->id;
There needs to be a space in between the WHERE clause as the polishedVals() method does not add a space after the implode. So, you'll have something like
UPDATE User SET city=:city, location=:locationWHERE User.id=28
Which causes the error.
Simple bug.

Insert/update helper function using PDO

I have a very simple helper function to produce SET statement for traditional plain mysql driver usage:
function dbSet($fields) {
$set='';
foreach ($fields as $field) {
if (isset($_POST[$field])) {
$set.="`$field`='".mysql_real_escape_string($_POST[$field])."', ";
}
}
return substr($set, 0, -2);
}
used like this
$id = intval($_POST['id']);
$fields = explode(" ","name surname lastname address zip fax phone");
$_POST['date'] = $_POST['y']."-".$_POST['m']."-".$_POST['d'];
$query = "UPDATE $table SET ".dbSet($fields)." stamp=NOW() WHERE id=$id";
it makes code quite DRY and easy but flexible at the same time.
I gotta ask if anyone willing to share a similar function, utilizing PDO prepared statements feature?
I am still in doubts, how to accomplish this.
Is there a straight and simple way to use PDO prepared statements to insert data?
What form it should be? Query builder helper? Or insert query helper? What parameters it should take?
I hope it can be easy enough to be used as an answer here on SO. Because in the every topic we can see prepared statements usage recommendation, but there is not a single good example. Real life example, I mean. To type bind_param() 20 times is not a good programming style I believe.
And even 20 question marks too.
I usually have a class extending PDO, but my class is pretty custom. If I get it cleaned up and tested I will post it at a later time. Here is a solution to your system, however.
function dbSet($fields, &$values) {
$set = '';
$values = array();
foreach ($fields as $field) {
if (isset($_POST[$field])) {
$set .= "`$field` = ?,";
$values[] = $_POST[$field];
}
}
return rtrim($set, ',');
}
$fields = explode(" ","name surname lastname address zip fax phone date");
$_POST['date'] = $_POST['y']."-".$_POST['m']."-"$_POST['d'];
$query = "UPDATE $table SET ".dbSet($fields, $values).", stamp=NOW() WHERE id=?";
$values[] = $id;
$dbh->prepare($query);
$dbh->execute($values);
This may not be perfect and could use tweaking. It takes into account that $dbh is setup with a PDO Connection. Pending any minor syntax issues I made, that should work.
EDIT
Really though, I think I would go for Doctrine ORM (or another ORM). As you setup the model and add all the validation there, then it is as simple as:
$table = new Table();
$table->fromArray($_POST);
$table->save();
That should populate the contents easily. This is of course with an ORM, like Doctrine.
UPDATED
Did some minor tweaks to the first code, such as putting isset back and using rtrim over substr. Going to work on providing a mock up of a PDO Extension class just gotta layout the way to do it and do some unit tests to make sure it works.
Thanks to everyone.
Every answer was helpful and I wish I could split the bounty.
At the end, to my surprise, I was able to make it the same way as before, based on on accepted answer
$fields = array("login","password");
$_POST['password'] = MD5($_POST['login'].$_POST['password']);
$stmt = $dbh->prepare("UPDATE users SET ".pdoSet($fields,$values)." WHERE id = :id");
$values["id"] = $_POST['id'];
$stmt->execute($values);
It can be wrapped into a helper function, but I doubt there is necessity. It will shorten the code by just one line.
pdoSet code:
function pdoSet($fields, &$values, $source = array()) {
$set = '';
$values = array();
if (!$source) $source = &$_POST;
foreach ($fields as $field) {
if (isset($source[$field])) {
$set.="`$field`=:$field, ";
$values[$field] = $source[$field];
}
}
return substr($set, 0, -2);
}
i would extend the Core PDO Class andd a method like so:
class Database extends PDO
{
public function QueryFromPost($Query,$items)
{
$params = array();
$Query .= ' WHERE ';
foreach($items as $key => $default)
{
$Query .= ' :' . $key. ' = ' . $key;
if(isset($_POST[$key]))
{
$params[':' . $key] = $_POST[$key];
}else
{
$params[':' . $key] = $default;
}
}
$s = $this->prepare($Query);
return $s->execute($params);
}
}
Then use like so
$db = new Database(/*..Default PDO Params*/);
$statement = $db->QueryFromPost('SELECT * FROM employees',array('type' => 'plc'));
foreach($preparedStatement->fetchAll() as $row)
{
//...
}
But as its already been said that you should be VERY weary of what your trying to do, you need to validate your data, its been sanitized but you not validated.
I've been patching something trivial together for what I consider recurring parameter binding cases.
http://fossil.include-once.org/hybrid7/wiki/db
Anyway; it provides some alternative prepared statement placeholders. Your example could be shortened into:
db("UPDATE table SET :, WHERE id=:id", $columns[], $where[]);
This case only works with named parameters, so $set would be array("name"=>..) and $where=array("id"=>123). The :, gets expanded on the first array you pass. It's replaced with comma-separated name=:name pairs (that's why its mnemonic is :,).
There are a few more placeholders :, :& :: and :? for different use cases. Only the ?? is really somewhat of a standard. So it needs some getting used to, but it significantly simplifies prepared statements and array binding (which PDO doesn't do natively).
Here's my general database abstraction class. Take a look at the autoExecute() function. It offers tons of flexibility for whatever it is you might want to accomplish. I should warn that this was written for PHP 5.3, and has been slightly tailored for PostgreSQL.
<?php
/**
* Database abstraction and query result classes
* Requires PHP 5.3
*
* Events:
* - on_commit - Dispatched when the transaction is successfully committed to the DB
* - on_rollback - Dispatched when the transaction is rolled back in the DB
*
* #author Kenaniah Cerny <kenaniah#gmail.com>
* #version 1.1.2
* #license http://creativecommons.org/licenses/by/3.0/us/
* #copyright Copyright (c) 2009, Kenaniah Cerny
*/
class Database extends PDO {
private $stmt;
private $good_trans = null;
private $nested_transactions = 0; //Keeps track of virtual transaction nesting level
private $callbacks = array();
private static $connections = array(); //Keeps track of opened connections
/**
* Returns a database instance using lazy instantiation
* #param string $name a database connection name
* #param array $config database config details for a new connection
*/
static function getInstance($name = 'main', $config=array()){
//Attempt to return an existing connection
if(array_key_exists($name, self::$connections)):
return self::$connections[$name];
endif;
//Attempt to create a new connection
$host = in_array($config['host'], array('localhost', '127.0.0.1')) ? "" : ";host=" . $config['host'];
$db = new Database($config['driver'].":dbname=".$config['name'].$host, $config['user'], $config['pass']);
//Save to connection pool
self::$connections[$name] = $db;
return $db;
}
/**
* Registers a callback to be run when the given event is invoked
* #param string $event Event name
* #param callable $callable
*/
public function register_listener($event, $callable){
if(!array_key_exists($event, $this->callbacks)):
$this->callbacks[$event] = array($callable);
else:
$this->callbacks[$event][] = $callable;
endif;
}
/**
* Invokes callbacks for the given event type
* #param string $event Event name
* #param boolean $stop_on_false Stops bubbling this event if one of the handlers returns false
*/
protected function dispatch_event($event, $stop_on_false = true){
if(!array_key_exists($event, $this->callbacks)) return;
foreach($this->callbacks[$event] as $callable):
$res = call_user_func($callable, $this, $event);
if($stop_on_false && $res === false) return false;
endforeach;
return true;
}
/**
* PDO Constructor
* #param $dsn
* #param $username
* #param $password
*/
function __construct($dsn, $username, $password) {
parent::__construct($dsn, $username, $password);
}
/**
* Prepares an SQL statement
* #param string $sql
*/
function prepare($sql) {
$stmt = parent::prepare($sql, array(PDO::ATTR_STATEMENT_CLASS => array(__NAMESPACE__.'\DatabaseStatement')));
$stmt->setFetchMode(PDO::FETCH_ASSOC);
return $stmt;
}
/**
* Prepares an executes an SQL statement with the parameters provided
* #param string $sql
* #param array $params
*/
function execute($sql, $params = array()) {
if($this->debug):
var_dump("Statement:\n".$sql."\nParams: ".$this->fmt($params));
endif;
try {
$stmt = $this->prepare($sql);
$val = $stmt->execute((array) $params);
if($stmt->errorCode() != '00000') error_log($this->errormsg());
if($this->debug && $stmt->errorCode() != '00000'){
var_dump($stmt->errorInfo());
Errors::add("Database error: ".$this->errormsg(), E_USER_ERROR);
}
if(!$val) return false;
} catch (PDOException $e){
if($this->debug) var_dump($stmt->errorInfo());
error_log($this->errormsg());
Errors::add("Database error: ".$this->errormsg(), E_USER_ERROR);
if($this->nested_transactions) $this->failTrans();
else throw $e;
}
$this->stmt = $stmt;
return $stmt;
}
/**
* Returns the value of the first column of the first row
* of the database result.
* #param $sql
* #param $params
*/
function getOne($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getOne() : false;
}
/**
* Fetches a single column (the first column) of a result set
* #param $sql
* #param $params
*/
function getCol($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getCol() : false;
}
/**
* Fetches rows in associative array format
* #param $sql
* #param $params
*/
function getAssoc($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getAssoc() : false;
}
/**
* Fetches rows in array format with columns
* indexed by ordinal position
* #param $sql
* #param $params
*/
function getArray($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getArray() : false;
}
/**
* Fetches all rows in associative array format
* #param $sql
* #param $params
*/
function getAll($sql, $params = array()){
return $this->getAssoc($sql, $params);
}
/**
* Fetches rows in array format where the first column
* is the key name and all other columns are values
* #param $sql
* #param $params
*/
function getKeyPair($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getKeyPair() : false;
}
/**
* Fetches rows in multi-dimensional format where the first
* column is the key name and all other colums are grouped
* into associative arrays for each row
* #param $sql
* #param $params
*/
function getGroup($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getGroup() : false;
}
/**
* Fetches only the first row and returns it as an
* associative array
* #param $sql
* #param $params
*/
function getRow($sql, $params = array()){
$stmt = $this->execute($sql, $params);
return $stmt ? $stmt->getRow() : false;
}
/**
* Internal function used for formatting parameters in debug output
* #param unknown_type $params
*/
private function fmt($params){
$arr = array();
foreach((array) $params as $k=>$v){
if(is_null($v)) $v = "NULL";
elseif(is_bool($v)) $v = $v ? "TRUE" : "FALSE";
$arr[] = "[".$k."] => ".$v;
}
return "Array(".join(", ", $arr).")";
}
/**
* Returns the number of affected rows from an executed statement
*/
function affected_rows(){
return $this->stmt ? $this->stmt->rowcount() : false;
}
/**
* Automated statement processing
*
* Params array takes the following fields:
*
* - table The name of the table to run the query on
*
* - data A key-value paired array of table data
*
* - mode INSERT, UPDATE, REPLACE, or NEW
*
* - where Can be a string or key-value set. Not used on INSERTs
* If key-value set and numerically indexed, uses values from data
* If key-value and keys are named, uses its own values
*
* - params An array of param values for the where clause
*
* - returning Optional string defining what to return from query.
* Uses PostgreSQL's RETURNING construct
*
* This method will return either a boolean indicating success, an array
* containing the data requested by returning, or a boolean FALSE indicating
* a failed query.
*
*/
function autoExecute($table, $params, $data){
$fields = array(); //Temp array for field names
$values = array(); //Temp array for field values
$set = array(); //Temp array for update sets
$ins = array(); //Insert value arguments
$params['table'] = $table;
$params['data'] = $data;
$params['params'] = (array) $params['params'];
//Parse the data set and prepare it for different query types
foreach((array) $params['data'] as $field => $val):
$fields[] = $field;
$values[] = $val;
$ins[] = "?";
$set[] = $field . " = ?";
endforeach;
//Check for and convert the array/object version of the where clause param
if(is_object($params['where']) || is_array($params['where'])):
$clause = array();
$params['params'] = array(); //Reset the parameters list
foreach($params['where'] as $key => $val):
if(is_numeric($key)):
//Numerically indexed elements use their values as field names
//and values from the data array as param values
$field = $val;
$params['params'][] = $params['data'][$val];
else:
//Named elements use their own names and values
$field = $key;
$params['params'][] = $val;
endif;
$clause[] = $field . " = ?";
endforeach;
$params['where'] = join(" AND ", $clause);
endif;
//Figure out what type of query we want to run
$mode = strtoupper($params['mode']);
switch($mode):
case 'NEW':
case 'INSERT':
//Build the insert query
if(count($fields)):
$sql = "INSERT INTO " . $params['table']
. " (" . join(", ", $fields) . ")"
. " SELECT " . join(", ", $ins);
else:
$sql = "INSERT INTO " . $params['table']
. " DEFAULT VALUES";
endif;
//Do we need to add a conditional check?
if($mode == "NEW" && count($fields)):
$sql .= " WHERE NOT EXISTS ("
. " SELECT 1 FROM " . $params['table']
. " WHERE " . $params['where']
. " )";
//Add in where clause params
$values = array_merge($values, $params['params']);
endif;
//Do we need to add a returning clause?
if($params['returning']):
$sql .= " RETURNING " . $params['returning'];
endif;
//Execute our query
$result = $this->getRow($sql, $values);
//Return our result
if($params['returning']):
return $result;
else:
return $result !== false;
endif;
break;
case 'UPDATE':
if(!count($fields)) return false;
//Build the update query
$sql = "UPDATE " . $params['table']
. " SET " . join(", ", $set)
. " WHERE " . $params['where'];
//Do we need to add a returning clause?
if($params['returning']):
$sql .= " RETURNING " . $params['returning'];
endif;
//Add in where clause params
$values = array_merge($values, $params['params']);
//Execute our query
$result = $this->getRow($sql, $values);
//Return our result
if($params['returning']):
return $result;
else:
return $result !== false;
endif;
break;
case 'REPLACE': //UPDATE or INSERT
//Attempt an UPDATE
$params['mode'] = "UPDATE";
$result = $this->autoExecute($params['table'], $params, $params['data']);
//Attempt an INSERT if UPDATE didn't match anything
if($this->affected_rows() === 0):
$params['mode'] = "INSERT";
$result = $this->autoExecute($params['table'], $params, $params['data']);
endif;
return $result;
break;
case 'DELETE':
//Don't run if we don't have a where clause
if(!$params['where']) return false;
//Build the delete query
$sql = "DELETE FROM " . $params['table']
. " WHERE " . $params['where'];
//Do we need to add a returning clause?
if($params['returning']):
$sql .= " RETURNING " . $params['returning'];
endif;
//Execute our query
$result = $this->getRow($sql, $params['params']);
//Return our result
if($params['returning']):
return $result;
else:
return $result !== false;
endif;
break;
default:
user_error('AutoExecute called incorrectly', E_USER_ERROR);
break;
endswitch;
}
/**
* #see $this->startTrans()
*/
function beginTransaction(){
$this->startTrans();
}
/**
* Starts a smart transaction handler. Transaction nesting is emulated
* by this class.
*/
function startTrans(){
$this->nested_transactions++;
if($this->debug) var_dump("Starting transaction. Nesting level: " . $this->nested_transactions);
//Do we need to begin an actual transaction?
if($this->nested_transactions === 1):
parent::beginTransaction();
$this->good_trans = true;
$this->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
endif;
}
/**
* Returns TRUE if the transaction will attempt to commit, and
* FALSE if the transaction will be rolled back upon completion.
*/
function isGoodTrans(){
return $this->good_trans;
}
/**
* Marks a transaction as a failure. Transaction will be rolled back
* upon completion.
*/
function failTrans(){
if($this->nested_transactions) $this->good_trans = false;
if($this->debug):
Errors::add("Database transaction failed: ".$this->errorMsg());
endif;
$this->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_SILENT);
}
/**
* #see $this->rollbackTrans()
*/
function rollback(){
$this->rollbackTrans();
}
/**
* Rolls back the entire transaction and completes the current nested
* transaction. If there are no more nested transactions, an actual
* rollback is issued to the database.
*/
function rollbackTrans(){
if($this->nested_transactions):
$this->nested_transactions--;
if($this->debug) var_dump("Rollback requested. New nesting level: " . $this->nested_transactions);
$this->good_trans = false;
if($this->nested_transactions === 0):
$this->good_trans = null;
$this->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_SILENT);
if($this->debug) var_dump("Transaction rolled back.");
parent::rollback();
$this->dispatch_event('on_rollback');
endif;
endif;
}
/**
* Clears the nested transactions stack and issues a rollback to the database.
*/
function fullRollback(){
while($this->nested_transactions) $this->rollbackTrans();
}
/**
* Returns the number of nested transactions:
* 0 - There is no transaction in progress
* 1 - There is one transaction pending
* >1 - There are nested transactions in progress
*/
function pending_trans(){
return $this->nested_transactions;
}
/**
* #see $this->completeTrans()
*/
function commit($fail_on_user_errors = false){
return $this->completeTrans($fail_on_user_errors);
}
/**
* Completes the current transaction and issues a commit or rollback to the database
* if there are no more nested transactions. If $fail_on_user_errors is set, the
* transaction will automatically fail if any errors are queued in the Errors class.
* #param boolean $fail_on_user_errors
*/
function completeTrans($fail_on_user_errors = false){
if(!$this->nested_transactions) return;
//Fail the transaction if we have user errors in the queue
if($fail_on_user_errors && Errors::exist()) $this->good_trans = false;
//Do we actually need to attempt to commit the transaction?
if($this->nested_transactions === 1):
if(!$this->good_trans || !parent::commit()){
if($this->debug) var_dump("Transaction failed: " . $this->errormsg());
$this->rollbackTrans();
return false;
}
//Transaction was good
$this->nested_transactions--;
$this->good_trans = null;
$this->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_SILENT);
if($this->debug) var_dump("Transaction committed.");
$this->dispatch_event('on_commit', false);
return true;
else:
//Don't take action just yet as we are still nested
$this->nested_transactions--;
if($this->debug) var_dump("Virtual commit. New nesting level: " . $this->nested_transactions);
endif;
return $this->good_trans;
}
/**
* Returns the text of the most recently encountered error
*/
function errormsg(){
$msg = $this->errorInfo();
return $msg[2];
}
}
class DatabaseStatement extends \PDOStatement implements \Countable {
/**
* Binds passed parameters according to their PHP type and executes
* the prepared statement
*/
function execute($params = array()) {
$i = 1;
foreach($params as $k => $v):
$mode = PDO::PARAM_STR;
if(is_null($v)) $mode = PDO::PARAM_NULL;
elseif(is_bool($v)) $mode = PDO::PARAM_BOOL;
elseif(is_resource($v)) $mode = PDO::PARAM_LOB;
$this->bindParam($i, $params[$k], $mode);
$i++;
endforeach;
$ok = parent::execute();
return $ok ? $this : false;
}
/**
* Returns the value of the first column of the first row
*/
function getOne() {
return $this->fetchColumn(0);
}
/**
* Returns an array of values of the column found at $index
* position.
* #param $index
*/
function getCol($index=0) {
return $this->fetchAll(PDO::FETCH_COLUMN, $index);
}
/**
* Returns all rows in numeric array format
*/
function getArray(){
return $this->fetchAll(PDO::FETCH_NUM);
}
/*
* Returns all rows in associative array format
*/
function getAll(){
return $this->fetchAll(PDO::FETCH_ASSOC);
}
/**
* Returns all rows in associative array format
*/
function getAssoc() {
return $this->fetchAll(PDO::FETCH_ASSOC);
}
/**
* Returns rows in multi-dimensional format where the first
* column is the key name and all other colums are grouped
* into associative arrays for each row
*/
function getGroup() {
return $this->fetchAll(PDO::FETCH_GROUP);
}
/**
* Returns a single row in associative format
*/
function getRow(){
return $this->fetch(PDO::FETCH_ASSOC);
}
/**
* Fetches rows in array format where the first column
* is the key name and all other columns are values
*/
function getKeyPair(){
//Emulate it
$tmp = $this->fetchAll(PDO::FETCH_ASSOC);
$arr = array();
for($i = 0; $i < count($tmp); $i++){
$arr[array_shift($tmp[$i])] = count($tmp[$i]) > 1 ? $tmp[$i] : array_shift($tmp[$i]);
}
return $arr;
}
/**
* Returns the number of rows returned by this statement
*/
function recordCount(){
return $this->rowCount();
}
/**
* Returns the number of rows returned by this statement
*/
function count(){
return $this->rowCount();
}
}
Even though my DB class does not use prepared statements I still want to mention it here. I see no reason at all to implement everything with prepared statements. I do know that prepared statements are faster, but only when used multiple times. If you execute the query only once (and this is the only type of query I normally need to use), it is slower. Thus it is counterproductive to use prepared statements everywhere.
Proper description of the class may be found some place else at stackoverflow. But here some of the good stuff:
Less then 100 lines database layer
DB::x for DB::instance()->execute and DB::q for DB::instance()->query
autoQuoting with two types of placeholders ? and ?x (where x may be ,, & and |). The ?, placeholder may be used as an UPDATE helper here.
But for full information see the stackoverflow post linked above ;)
PS: The README in the repo does not apply to this class. It is for the normal DB.php, not for DB_intelligent.php.
PPS: The class is written for PHP 5.3. If you want to use it on PHP 5.2 simply copy all those PDO methods from DB_forPHP52.php to DB_intelligent.php and remove the __callStatic method.
Just in addition to other answers: a method for proper quote of column names:
/**
* Escape identifier (database/table/column name) - ie. if you're using MySQL:
* db_name.tbl_name.col_name -> `db_name`.`tbl_name`.`col_name`
**/
protected function quoteIdentifier($identifier) {
static $escapeChars = array(
'mysql' => '``',
'oracle' => '""',
'mssql' => '[]',
//...
);
$escape = $escapeChars[$this->getAttribute(self::ATTR_DRIVER_NAME)];
$identifier = (array) explode('.', $identifier);
$identifier = array_map(function($segment) use($escape) {
return $escape[0] . $segment . $escape[1];
}, $identifier);
return implode('.', $identifier);
}
You can extend PDO like that:
class CustomPDO extends PDO {
public function updateTable($sTable, array $aValues = array()){
if (!empty($aValues) && !empty($sTable)){
# validation of table / columns name
$sTable = mysql_real_escape_string($sTable);
$aColumns = array_map('mysql_real_escape_string',array_keys($aValues));
$aElements = array();
foreach ($aColumns as $sColumn){
$aElements[] = "`$sColumn`= :$sColumn";
} // foreach
$sStatement = "UPDATE $sTable SET " . implode(',', $aElements);
$oPDOStatement = $this->prepare($sStatement);
if ($oPDOStatement){
return $oPDOStatement->execute($aValues);
} // if
} // if
return false;
} // updateTable
}
# usage :
# $oDb->updateTable('tbl_name',$_POST);
# test
error_reporting (E_ALL);
ini_Set('display_errors',1);
$oDb = new CustomPDO('sqlite::memory:');
$oDb->exec('CREATE TABLE t1(c1 TEXT, c2 INTEGER)');
$oDb->exec("INSERT INTO t1(c1, c2) VALUES ('X1',1)");
var_dump($oDb->query('SELECT * FROM t1')->fetchAll(PDO::FETCH_ASSOC));
$oDb->updateTable('t1', array('c1'=>'f1','c2**2'=>2));
var_dump($oDb->query('SELECT * FROM t1')->fetchAll(PDO::FETCH_ASSOC));
Like others I've extended the standard PDO class to suit my needs. Something along the lines of this may suit you:
Class ExtendedPDO extends PDO
{
public function prepareArray($sql, array $data)
{
// Call the standard prepare method
$statement = parent::prepare($sql);
foreach ($data as $field=>$value) {
$statement->bindValue(':' . $field, $value);
}
return $statement;
}
}
Then you can use it quite simply:
// Include connection variables
include '../includes/config/database.php';
// The data to use in the query
$data = array(
'title' => 'New value',
'id' => 1,
);
// The query you want to run
$sql = '
UPDATE
test
SET
title = :title
WHERE
id = :id
';
try {
// Connect to the database
$dbh = new ExtendedPDO(PDO_DSN, PDO_USERNAME, PDO_PASSWORD);
// Attach the data to your query
$stmt = $dbh->prepareArray($sql, $data);
// Run it
$stmt->execute();
} catch (PDO Exception $e) {
echo $e->getMessage();
}
Insert queries often require many placeholders. The question mark style is then hard to read, and named parameters are repetitive and prone to typing errors. So, I created a function for the whole insert query:
function insert($table, $col_val){
global $db;
$table = preg_replace('/[^\da-z_]/i', '', $table);
$smt = $db->prepare("DESCRIBE `$table`");
$smt->execute();
$columns = $smt->fetchAll(PDO::FETCH_COLUMN);
$sets = array();
$exec = array();
foreach($col_val as $col => $val){
if(!in_array($col, $columns))
return false;
$sets[] .= "`$col`=?";
$exec[] = $val;
}
$set = implode(',', $sets);
$smt = $db->prepare("INSERT INTO `$table` SET $set");
$smt->execute($exec);
return $db->lastInsertId();
}
Usage is simple:
insert('table_name', array(
'msg' => 'New message',
'added' => date('Y-m-d H:i:s'),
));
And if you need lastInsertId():
$new_id = insert(...
Reference: How can I prevent SQL injection in PHP?
$preparedStatement = $db->prepare('SELECT * FROM employees WHERE name = :name');
$preparedStatement->execute(array(':name' => $name));
$rows = $preparedStatement->fetchAll();

Categories