Multiple mysqli prepared statements with transactions - php

I'm trying to figure out how to use sql transactions with mysqli prepared statements. I haven't been able to find any examples that use multiple prepared statements (that aren't OO), so I'm not really sure how to use transactions with them.
This is the closest I could figure:
mysqli_autocommit($database, FALSE);
$transferq = 'INSERT INTO money (user_id, bank, onhand, type, amount, source) VALUES (?, ?, ?, ?, ?, ?)';
$transferstmt = mysqli_stmt_init($database);
mysqli_stmt_prepare($transferstmt, $transferq);
mysqli_stmt_bind_param($transferstmt, 'iiisis', $userid, $newbank, $newmoney, $type, $amount, $source);
mysqli_stmt_execute($transferstmt);
$insertq = 'UPDATE users SET money=?, bank=? WHERE user_id=' . $userid . ' LIMIT 1';
$insertstmt = mysqli_stmt_init($database);
mysqli_stmt_prepare($insertstmt, $insertq);
mysqli_stmt_bind_param($insertstmt, 'ii', $newmoney, $newbank);
mysqli_stmt_execute($insertstmt);
mysqli_commit($database);
But, I have no idea if that would even work. My biggest issue, though, is I'm not sure how to check if the queries failed or not (and therefore whether or not to commit). I saw an example that I think did something like
if(mysqli_stmt_execute($stmt)){
mysqli_commit($database);
}else{
mysqli_rollback($database);
}
But I can't really do that since I have multiple prepared statements to execute.
How is this supposed to work?

Maybe I did not understand your question, but what about this?
mysqli_autocommit($database, FALSE);
$transferq = 'INSERT INTO money (user_id, bank, onhand, type, amount, source) VALUES (?, ?, ?, ?, ?, ?)';
$transferstmt = mysqli_stmt_init($database);
mysqli_stmt_prepare($transferstmt, $transferq);
mysqli_stmt_bind_param($transferstmt, 'iiisis', $userid, $newbank, $newmoney, $type, $amount, $source);
if (not mysqli_stmt_execute($transferstmt) ){
mysqli_rollback($database);
return;
}
$insertq = 'UPDATE users SET money=?, bank=? WHERE user_id=' . $userid . ' LIMIT 1';
$insertstmt = mysqli_stmt_init($database);
mysqli_stmt_prepare($insertstmt, $insertq);
mysqli_stmt_bind_param($insertstmt, 'ii', $newmoney, $newbank);
if (not mysqli_stmt_execute($insertstmt) ){
mysqli_rollback($database);
return;
}
mysqli_commit($database);
The next level if form of this object-oriented using of mysqli or PDO (without transactions, as example of way of work with database):
class my_database{
private static $inner_link_to_driver;
protected static function factory( ){
if (not static::$inner_link_to_driver){
static::$inner_link_to_driver = new ...(USER, SERVER, PASSWD, PORT);
}
return static::$inner_link_to_driver;
}
public static function do_something($params, &$message ){
$query = "...";
$stmt = static::factory()->prepare($query);
if (not $stmp ){
$message = 'Error prepare query '.$query.PHP_EOL.static::factory()-> ..(get_error);
return FALSE;
}
if (not $stmt->execute($params) ){
$message = 'Error execute query '.$query.PHP_EOL.static::factory()-> ..(get_error);
return FALSE;
}
return TRUE;
}
}

Related

Binding to parameters with odbc_exec

I am using a Microsoft Access Database and am connected to it by ODBC in my PHP code. I have looked online and the PHP manual says that odbc_exec prepares and executes the statement.
My code has parameters to avoid an sql injection but I cannot use odbc_prepare and odbc_execute as they are not supported by MS Access. I am having trouble finding out how to bind my variables to the parameters in my sql statement.
PHP
<?php
$con=odbc_connect("InventoryDB", "", "");
if (isset($_POST['partNumber'])) {
$partNum = $_POST['partNumber'];
}
if (isset($_POST['manufacturer'])) {
$manufacturer = $_POST['manufacturer'];
}
if (isset($_POST['supplier'])) {
$supplier = $_POST['supplier'];
}
if (isset($_POST['catalogNumber'])) {
$catalogNumber = $_POST['catalogNumber'];
}
if (isset($_POST['deviceFamily'])) {
$deviceFamily = $_POST['deviceFamily'];
}
if (isset($_POST['listPrice'])) {
$listPrice = $_POST['listPrice'];
}
if (isset($_POST['quantity'])) {
$quantity = $_POST['quantity'];
}
if (isset($_POST['packets'])) {
$packets = $_POST['packets'];
}
$stmt = odbc_prepare($con, 'INSERT INTO Parts (PartNumber, Manufacturer, Supplier, CatalogNumber, DeviceFamily, ListPrice, Quantity, Packets) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'); // Insert all of the values from the form into the table
$rs = odbc_execute($stmt, array($partNum, $manufacturer, $supplier, $catalogNumber, $deviceFamily, $listPrice, $quantity, $packets));
?>
I would like to know how to do what I am currently doing with prepare and execute using just odbc_exec.
The values all come from a form to add to the database which shows the inventory of a company.
EDIT
The error that using prepare and execute returns is odbc_prepare():
SQL error: [Microsoft][ODBC Driver Manager] Driver does not support this
function, SQL state IM001 in SQLDescribeParameter
Consider PHP's generalized DB-API, PDO, that among other RBDMS's can connect to MS Access via ODBC for parameterized queries. You may need to enable php_pdo_odbc in .ini file:
$database = "C:\\path\\to\\mydatabase.accdb";
// WITH DSN
$dbh = new PDO("odbc:DSN=MS Access Database;DBq=$database;");
// WITH DRIVER
// $dbh = new PDO("odbc:Driver={Microsoft Access Driver (*.mdb, *.accdb)};DBq=$database;");
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO Parts (PartNumber, Manufacturer, Supplier, CatalogNumber,
DeviceFamily, ListPrice, Quantity, Packets)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
try {
$sth = $dbh->prepare($sql);
$sth->execute(array($partNum, $manufacturer, $supplier, $catalogNumber,
$deviceFamily, $listPrice, $quantity, $packets));
}
catch(PDOException $e) {
echo $e->getMessage()."\n";
}
// CLOSE CONNECTION
$dbh = null;
If you can't use odbc_prepare you have to generate your SQL statement as a string and do the best you can to defend against SQL injection. By far the biggest problem is the ' character. I use these two functions:
function Qs($Text) { return(str_replace("'","''",$Text)); }
function Qsz($Text) { return(empty($Text)?'NULL':("'".Qs($Text)."'")); }
The first just avoids issues with '. I use the second if I want to insert NULL instead of an empty string (usually the case).
Use double quotes on generating your SQL statement, so they don't conflict with the single quotes inside the statement. Example (assuming both fields are text):
$sql = "INSERT INTO Parts (PartNumber, Manufacturer) VALUES (".Qsz($_POST['partNumber']).",".Qsz($_POST['partNumber']).")";

My PDO query seems to randomly stop working?

How can I troubleshoot further? I have 3 styles of querying. This is for a fetchType = 'single' ( single row that is) and a populated parameterArray
public function query($fetchType, $queryType, $parameterArray=null)
{
$query=$this->sql_array[$queryType];
if($parameterArray==null)
{
$pdoStatement = $this->db_one->query($query);
$results = $pdoStatement->fetchAll(PDO::FETCH_ASSOC);
return $results;
}
$this->db_one->quote($query);
$pdoStatement = $this->db_one->prepare($query);
$results = $pdoStatement->execute($parameterArray);
if($fetchType=='single')
{
$results = $pdoStatement->fetch(PDO::FETCH_ASSOC);
}
else if($fetchType=='multiple')
{
$results = $pdoStatement->fetchAll(PDO::FETCH_ASSOC);
}
return $results;
}
My results is coming back false and I see no data in the sql table.
I verified that the queryType exists in the lookup table and that other queries are working.
Here is the actual query. I inserted new lines to make readable.
"signup_insert" =>
"INSERT INTO credentials
(h_token, h_file, h_pass, email, name, picture, privacy)
VALUES (?, ?, ?, ?, ?, ?, ?)"
Here is the debug code I created:
$pipe['debug_h_token']=$h_token;
$pipe['debug_h_file']=$h_file;
$pipe['debug_h_pass']=$h_pass;
$pipe['debug_email']=$this->TO->get('email');
$pipe['debug_name']=$this->TO->get('name');
$pipe['debug_picture']=$picture;
$pipe['debug_privacy']=$privacy;
$test = $this->DBO->query('single', 'signup_insert', array(
$h_token,
$h_file,
$h_pass,
$this->TO->get('email'),
$this->TO->get('name'),
$picture,
$privacy
));
$pipe['debug_test'] = $test;

Use lastInsertId() multiple times on different queries in transaction

So I've been trying to find an answer but I don't think there is one that is specified to what I am trying to do. I will start with my sample of code
file.php
$q = "INSERT INTO ".PORTAL_DB.".resource_file (company__id, rf_category__id, title, file_name, description, path, upload_by, has_quiz)
SELECT ?, ?, ?, CONCAT(MAX(id)+1, '.', '$extension'), ?, ?, ?, ? FROM ".PORTAL_DB.".resource_file";
$stmt = $CONN->prepare($q);
$filename = 0;
$resource_file__id = 0;
if($stmt->execute(array($company__id, $rf_category__id, $title, $description, "assets/$uploadFolder/", USER, $has_quiz))){
$filename = $CONN->lastInsertId();
$resource_file__id = $filename;
}
if(!empty($quiz)){
$passing_score = $quiz->passing_score;
if(!is_numeric($passing_score) or ($passing_score < 0) or $passing_score > 100){
$CONN->rollback();
throw new Exception("Invalid passing score value for quiz, please fix");
}
$q = "INSERT INTO ".PORTAL_DB.".rf_quiz (resource_file__id, passing_score)
VALUES(?, ?)";
$stmt = $CONN->prepare($q);
$rf_quiz__id = 0;
$stmt->execute(array($resource_file__id, $passing_score));
print_r($CONN->lastInsertId);
exit;
$question_ids = array();
foreach($quiz as $qz){
$question = $qz->question;
//print_r($qz);
$q = "INSERT INTO ".PORTAL_DB.".rf_quiz_question (rf_quiz__id, question)
VALUES(?, ?)";
$stmt = $CONN->prepare($q);
if($stmt->execute(array($rf_quiz__id, $question))){
array_push($question_ids, $CONN->lastInsertId);
}
}
//print_r($question_ids);
exit; // using this for testing only
}
explanation
The above code is called after $CONN->beginTransaction() so that I can manage errors easier. From what I understand you can call the stamtement $CONN->lastInsertId() multiple times without issue, however I can get the first id which is stored under the variable $resource_fild__id then when we go down to the $rf_quiz__id variable, even if the call is successful, I get nothing and it causes an error. I want to be able to do all of this in one transaction for the ease of the coding process and organization.
I hope someone can point me in the right direction, or at least be able to tell me what I am doing wrong so that I can find a fast solution!
Thank you for all help in advance.

PHP - Converting PDO to normal code

I was wondering if someone could help me.
Im trying to integrate some code into my application, the code that i need to integrate is written with PDO statements and i have no idea how it goes.
I was wondering if someone could help me convert it.
The code is as follows
$sql = "insert into message2 (mid, seq, created_on_ip, created_by, body) values (?, ?, ?, ?, ?)";
$args = array($mid, $seq, '1.2.2.1', $currentUser, $body);
$stmt = $PDO->prepare($sql);
$stmt->execute($args);
if (empty($mid)) {
$mid = $PDO->lastInsertId();
}
$insertSql = "insert into message2_recips values ";
$holders = array();
$params = array();
foreach ($rows as $row) {
$holders[] = "(?, ?, ?, ?)";
$params[] = $mid;
$params[] = $seq;
$params[] = $row['uid'];
$params[] = $row['uid'] == $currentUser ? 'A' : 'N';
}
$insertSql .= implode(',', $holders);
$stmt = $PDO->prepare($insertSql);
$stmt->execute($params);
You shoudl use PDO unles for some technical reason you cant. If you dont know it, learn it. Maybe this will get you started:
/*
This the actual SQL query the "?" will be replaced with the values, and escaped accordingly
- ie. you dont need to use the equiv of mysql_real_escape_string - its going to do it
autmatically
*/
$sql = "insert into message2 (mid, seq, created_on_ip, created_by, body) values (?, ?, ?, ?, ?)";
// these are the values that will replace the ?
$args = array($mid, $seq, '1.2.2.1', $currentUser, $body);
// create a prepared statement object
$stmt = $PDO->prepare($sql);
// execute the statement with $args passed in to be used in place of the ?
// so the final query looks something like:
// insert into message2 (mid, seq, created_on_ip, created_by, body) values ($mid, $seq, 1.2.2.1, $currentUser, $body)
$stmt->execute($args);
if (empty($mid)) {
// $mid id is the value of the primary key for the last insert
$mid = $PDO->lastInsertId();
}
// create the first part of another query
$insertSql = "insert into message2_recips values ";
// an array for placeholders - ie. ? in the unprepared sql string
$holders = array();
// array for the params we will pass in as values to be substituted for the ?
$params = array();
// im not sure what the $rows are, but it looks like what we will do is loop
// over a recordset of related rows and do additional inserts based upon them
foreach ($rows as $row) {
// add a place holder string for this row
$holders[] = "(?, ?, ?, ?)";
// assign params
$params[] = $mid;
$params[] = $seq;
$params[] = $row['uid'];
$params[] = $row['uid'] == $currentUser ? 'A' : 'N';
}
// modify the query string to have additional place holders
// so if we have 3 rows the query will look like this:
// insert into message2_recips values (?, ?, ?, ?),(?, ?, ?, ?),(?, ?, ?, ?)
$insertSql .= implode(',', $holders);
// create a prepared statment
$stmt = $PDO->prepare($insertSql);
// execute the statement with the params
$stmt->execute($params);
PDO really is better. It has the same functionality as MySQLi but with a consistent interface across DB drivers (ie. as long as your SQL is compliant with a different database you can theoretically use the exact same php code with mysql, sqlite, postresql, etc.) AND much better parameter binding for prepared statements. Since you shouldnt be using the mysql extension any way, and MySQLi is more cumbersome to work with than PDO its really a no-brainer unless you specifically have to support an older version of PHP.

A better way to do this?

So this is my current code:
function addPage($uniquename, $ordernum, $title, $author, $content, $privilege, $description=NULL, $keywords=NULL){
if (!$description) $description = NULL;
if (!$keywords) $keywords = NULL;
//UPDATE `table` SET `ordernum` = `ordernum` + 1 WHERE `ordernum` >= 2
$query = "UPDATE ".$this->prefix."page SET ordernum = ordernum+1 WHERE ordernum >= ?";
if ($stmt = $this->db->prepare($query)){
$stmt->bind_param("i", $ordernum);
$stmt->execute();
if (!arCheck($stmt)) return false;
} else {
$this->stmtError("addPage", $stmt->error);
}
$query = "INSERT INTO ".$this->prefix."page VALUES (LCASE(?), ?, ?, ?, ?, ?, ?, ?)";
if ($stmt = $this->db->prepare($query)){
$stmt->bind_param("sisisssi", $uniquename, $ordernum, $title, $author, $content, $description, $keywords, $privilege);
$stmt->execute();
return arCheck($stmt);
} else {
$this->stmtError("addPage", $stmt->error);
}
}
It is suppose to add a new page to the datatable. The MySQL is courtesy of Phil Hunt from Store the order of something in MySQL
I know that you can use multiquery to accomplish the same thing, however I was told that prepared statement is better in performance, and security. Is there another way to do this? Like a prepared multi query?
Also, what about doing Transactions? I'm not fully sure of what that is, I assume that it's if, let's say, the INSERT statement fails, it will undo the UPDATE statement as well?
NOTE: the arCheck function will close the statement.
Prepared statements are indeed faster for repeated queries, at least in most cases. They're also safer because they automatically escape input values, preventing SQL injection attacks. If you want to use them in PHP you'll need the MySQLi extension.
You appear to have the right idea about transactions. With MySQLi there are commit and rollback methods, otherwise you can use mysql_query("COMMIT") or mysql_query("ROLLBACK").

Categories