php oop prepare statement [closed] - php

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 6 years ago.
Improve this question
Any idea to avoid to repeat this long messy code every time i want to get the data from the database in secure way?
public function test($param) {
$sql = "SELECT * FROM users WHERE id = :id AND item_id :item_id";
$this->_query = $this->_db->pdo()->prepare($sql);
$this->_query->bindValue(':id', $param);
$this->_query->bindValue(':item_id', $parmas);
$this->_query->execute();
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
}
i created good way not to mess around for a simple one like this
public function query($sql, $params = array()) {
$this->_error = false;
if($this->_query = $this->_pdo->prepare($sql)) {
if(count($params)) {
//outside of the loop
$x = 1;
foreach($params as $param) {
$this->_query->bindValue($x, $param);
$x++;
}
}
if($this->_query->execute()) {
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
$this->_count = $this->_query->rowCount();
} else {
$this->_error = true;
}
}
return $this;
}
pdo is already defined in the construct function in the class.
//im adding more details here and this is what im trying to make.
public function example($table, $params = array(), $extn = array(), $values = array()) {
$x = '';
$y = 0;
foreach($params as $param) {
$x .= $param;
if($y < count($params)) {
$x .= $extn[$y];
}
$y++;
}
$sql = "SELECT * FROM {$table} WHERE {$x}";
$this->_query = $this->_pdo->prepare($sql);
foreach($values as $value) {
$this->_query->bindValue($value);
}
$this->_query->execute();
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
}
but im getting this error Warning: PDOStatement::bindValue() expects at least 2 parameters,
with this code down below
$test = new Example();
$test->example('users', array('id = :id', 'username = :username', 'id = :username', 'username = :id'), array(' AND ', ' OR ', ' AND '), array("':id', 4", "':username', 'alex'"));
any suggestion will be helpful to me!!

Answer 1

Not to sound harsh, but there is a multitude o things wrong with your approach. Most immediate to your problem is that the passed $values are garbled.
I would expect the bindValues() in example to look something like this:
foreach ($values as $param => $value) {
$this->_query->bindValue($param, $value);
}
Consequently $values given to example() should look something like this:
$values = array(':id' => 4, ':username' => 'alex')
For reference see the php-docs on PDOStatement::bindValue()
Apart from that:
You just pass the variable $table into the query:
$sql = "SELECT * FROM {$table} WHERE {$x}";
This is unsafe! While you are more concerned about the values passed to the query (which is understandable) your will still have a vulnerability here.
Your class database stores the query and its result in a class variable. This is unnecessary (database engines have query caches, if you want those files cached in php you should results in a cache, e.g. by wrapping database in a class cached_database) and potentially will cause bugs when your query/results are accidentally reused or mixed up.
There are many ways to mess up your queries by giving the wrong parameters and because almost all of them are arrays it is hard to figure out what values to put in there. This makes your whole setup very fragile, e.g. it depends on the right number of $params and $extn passed to example which almost certainly will make problems in the future. Not only because it's hard to figure out what happens there, but also because it (most likely) lacks functionality you might want to use in the future such as queries with IN or BETWEEN. It may safe you from writing a few lines of code, but after not using it for a few weeks you will spend that time trying to figure out what happens and how to use it (and probably more). Trust me, we have all been there. ;)
I think you are much safer repeating the PDO-stuff which looks a bit repetitive, but is easily understood - especially when someone else takes over or is to help you in the future - and is well documented.
Should you feel the need to simplify common tasks like SELECT-ing similar data you should instead consider an ORM like Doctrine. Even just the Doctrine DBAL might help you because you get a powerful SQL Query Builder.
If you really want to keep your code and don't want to use other libraries try simplifying it using baby steps. Whenever a small part is repeated in exactly the same way put it into a private method. You could do this for example with these 3 lines in your first example:
$this->_query->execute();
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
return $this->_results;
Take your first code snippet:
class database {
$_results = null;
/***
#param array $param should be an array of two elements
***/
public function test($param = []) {
$sql = "SELECT * FROM users WHERE id = :id AND item_id :item_id";
$this->_query = $this->_db->pdo()->prepare($sql);
$this->_query->bindValue(':id', $param);
$this->_query->bindValue(':item_id', $param);
$this->_query->execute();
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
return $this->_results;
}
}
You could simplify it by just extracting bits you repeat often into smaller private methods:
/*
* Don't just call it "database", that's way to generic.
* Try to give it an explicit name, for example UserRepository
*/
class UserRepository
{
public function getUsersByIdAndItemId($id, $itemId) {
$sql = "SELECT * FROM users WHERE id = :id AND item_id :item_id";
$query = $this->getPreparedQuery($sql);
// No need to simplify this:
$query->bindValue(':id', $id);
$query->bindValue('item_id', $itemId);
return $this->executeQuery($statement);
}
public function getAllUsers()
{
$sql = "SELECT * FROM users";
$query = $this->getPreparedQuery($sql);
return $this->executeQuery($query);
}
private function getPreparedQuery($sqlQueryString)
{
/*
* No "$this->_query"
* You don't have to reuse it! Worst case scenario a diffeent
* method accidentally reuses the query and you get a PDOException.
*/
return $this->_db->pdo()->prepare($sqlQueryString);
}
private function executeQuery(\PDOStatement $query)
{
$statement->execute();
/**
* Again no need to store this in a class variable.
* Worst case scenario you end up with a dirty state
* or mixed up data
*/
return $statement->fetchAll(PDO::FETCH_OBJ);
}
}
This is much safer than your approach, because it's simple and clear. Your input is always secured and whenever you use UserRepsitory::findUsersByIdAndItemId() you can't accidentally send to many params or give them the wrong name or otherwise mess up the sql query. You just pass exactly the values you need. Sometimes violating "Don't repeat yourself" is ok if it makes your code more secure and better to understand.