Is it bad practice to use variable inside pdo query? [closed] - php

Question

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 6 years ago.
Improve this question
I have a PHP PDO query like this:
$update = $pdo->query("UPDATE login_users SET lastactivity = '$lastactivity' WHERE user_id = 1");
I like to do this way because I think my code looks better.
Is it ok to do this way? Or should I do like this:
$params = array(
':id' => $_SESSION['jigowatt']['user_id'],
':lastactivity' => $lastactivity,
);
$update = $pdo->query('UPDATE login_users SET lastactivity = :lastactivity WHERE user_id = :id', $params);

Answer 1

I have a PHP PDO query like this:
By no means you should have code like this.
Or should I do like this
Neither you are bound to write a prepared statements like that. There are other ways. For example, nobody's forcing you to use named placeholders. You can use positional, they are much more concise:
$sql = "UPDATE login_users SET lastactivity = ? WHERE user_id = ?";
$pdo->prepare($sql)->execute([$lastactivity],$_SESSION['jigowatt']['user_id']);

Answer 2

This is example of PDO "query wrapper":
public function sendQuery($queryString, array $queryParams = array())
{
try {
$stmt = $this->_PDO->prepare($queryString);
$stmt->execute($queryParams);
} catch (\PDOException $e) {
if ($this->_PDO->inTransaction()) {
$this->_PDO->rollBack();
}
throw $e; // this line for example only (see comments of this answer)
}
return $stmt;
}
Can be use like this:
$conn = \DBI::getConnection(); // DBI return DBC object
$x = $conn->sendQuery(
'SELECT x FROM tbl WHERE y = :y',
[':y' => $y]
)->fetch(\PDO::FETCH_COLUMN);