Mysqli to PDO - If else statement to try catch - php

Question

I'm trying to convert some mysqli code to PDO.
Before I had this:
$updateTaskQuery = "UPDATE `task` SET `user_id` = {$query['user_id']}, `status_id` = {$query['status_id']} WHERE `id` = {$query['task_id']}";
$updateTask = mysqli_query($mysqli, $updateTaskQuery);
//### Check for error
if($mysqliError = mysqli_error($mysqli)) {
echo json_encode(array('error' => 'Update Task MySQLi Error: '.$mysqliError));
exit;
} else {
echo json_encode(array('success' => true));
exit;
}
So far, I have convertet it to this:
$sql = $db->prepare ( "UPDATE `task` SET `user_id` = {$query['user_id']}, `status_id` = {$query['status_id']} WHERE `id` = {$query['task_id']}" );
$sql->execute ();
$updateTask = $sql->fetchAll ( PDO::FETCH_ASSOC );
try {
$updateTask;
} catch ( PDOException $ex ) {
//handle
}
My question here is, how can I include my else statement in the new code?
UPDATE: Wrong, but working code
try {
// Update task
$query = $db->prepare ( "UPDATE `task` SET `user_id` = {$query['user_id']}, `status_id` = {$query['status_id']} WHERE `id` = {$query['task_id']}" );
$query->execute();
echo json_encode ( array (
'success' => true
) );
} catch ( PDOException $e ) {
// catch a pdo error
echo json_encode ( array (
'error' => 'Update Task PDO Error: ' . $e->getMessage (),
'error_trace' => $e->getTraceAsString ()
) );
}

Answer 1

you have a lot wrong here, I will see If i can help - I haven't "tested" this but it should be really close.
//your using json so set the correct content headers
header('Content-Type: application/json');
//try only works on code you "try" anything outside isn't included in the try block
try{
//connect
$PDO = new PDO(
'mysql:host=' . $_dbHost . ';' . 'dbname=' . $_dbName,
$_dbUser,
$_dbPass
);
//set exception error mode
$PDO->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
//set fetch assoc array as default
$PDO->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);
//query with named placeholders ( even pdo can get sql injection when you dont use placeholders )
$sql = 'UPDATE `task` SET `user_id` = :user_id, `status_id` = :status_id WHERE `id` = :id';
//prepare query
$stmt = $PDO->prepare( $sql );
//execute with data
$stmt->execute(array(
':user_id' => $query['user_id'],
':status_id' => $query['status_id'],
':id' => $query['id'],
));
echo json_encode(array(
'success' => true,
'results' => $stmt->fetchAll()
)
);
}catch( PDOException $e ){
//catch a pdo error
echo json_encode(array(
'error' => 'Update Task PDO Error: '.$e->getMessage(),
'error_trace' => $e->getTraceAsString()
)
);
}catch( Exception $e ){
//the beauty of exceptions ~ catch some other non-pdo exception
echo json_encode(array(
'error' => 'Runtime Error: '.$e->getMessage(),
'error_trace' => $e->getTraceAsString()
)
);
}
///more code can go here
To answer your question, you don't need the else statement any longer. Everything in the try block with run until it throws an exception, then it will land in the appropriate catch block and run that code. In that block you can get the error messages by referencing the variable you set for the exception class instance to use, in this case I set $e. This is a common convention to use $e just as it is to use $i for iteration on a loop. Generally I wont use short variables like this except in cases where the variable is not a integral part of your code. In this case $e is not something I expect to use outside of the catch.
I also included the proper content header. This will help javascript libraries such as jQuery parse the JSON properly when they return the data.
I love these kinds of questions, so I hope my explanation has helped you to understand PDO and Exceptions a bit more. Your on the right track using them.
One last note is you can run more code after the try catch blocks.
To explain my comment ( about wrong code that works ), when you don't sanitize input in your SQL you get nasty things like this. Assume we have this query:
$sql = "UPDATE
`task`
SET
`user_id` = {$query['user_id']},
`status_id` = {$query['status_id']}
WHERE
`id` = {$query['task_id']}
";
The problem here is if someone enters a chunk of sql into one of your inputs such as
$query['task_id'] = '0; DROP table task;';
What this does is complete your query and drop your table!
$sql = "UPDATE
`task`
SET
`user_id` = 1,
`status_id` = 2
WHERE
`id` = 0;
DROP table task;
";
While I am by no means and expert at SQL injection, as I never have done it, that's the gist of it. There are a lot of things they can do worse then dropping tables, such as creating database users. Accessing files on the system, such as password files for system users or other confidential information. Not to mention a whole plethora of second stage attacks such as adding malicious javascript. Which would be printed on the screen and allow them to do XSS ( cross site scripting ) type attacks on site visitors etc...
Trust me even if you think you don't have anything worth "stealing" on your site. It's better to learn the right way then the hard way on something like this. Sorry if I'm a bit harsh on this but it is a very important concept to learn if you plan to do any "serious" coding.
Just because something doesn't work strait off, such as a code "sample" that I provided ( I did explicitly say I didn't test it ). Doesn't mean there is a fundamental problem with it ( it was a simple copy paste error ). The "wrong" code that works is fundamentally flawed.