PHP-PDO try/catch inserting dynamic html link - php

Question

it seems i have run into a slight problem in my first shot at using PDO and prepared statements. Basically I am working on a profile page which includes an Inbox. I am using try/catch to produce the inbox:
<?php
$sqlin = $db->prepare("SELECT * FROM message WHERE recipientID = (SELECT id FROM members WHERE username = '$pageowner')");
try {
while($row = $sqlin->fetch(PDO::FETCH_ASSOC)){
?>
<br><?php echo $row['title'] ?>
<?php
}
}
catch(PDOException $e) {
die ($e->getMessage());
}
?>
So this is supposed to relate the user id to the recipient id, and then create links to the messages. When I run in browser no links are listed
Is this an issue within my try/catch syntax? maybe stopping the php and inserting the html?--I tried echoing out but ran into problems creating that code.

Answer 1

You have to start to try/catch the exception before the prepare() and after it. And please use prepared statement, with prepare() method. Otherwise, you are defeating the purpuse of PDO by directly placing your variables inside the query. Which does not make your script safer from mysql injection.
$pageOwner = 'some external data';
try {
$sqlin = $db->prepare("
SELECT * FROM message
WHERE recipientID = (
SELECT id
FROM members
WHERE username = ?
)
");
$sqlin->execute(array($pageOwner));
}catch(PDOException $e){
die ($e->getMessage());
}
while($row = $sqlin->fetch(PDO::FETCH_ASSOC)){
?>
<br><?= $row['title'] ?>
<?php } ?>

Answer 2

first, you shouldn't use try..catch here at all.
Instead, you have to call execute() and use prepared statements.
Also you have to separate your SQL from HTML.
Here is the proper code.
<?php
$sql = "SELECT m.* FROM message m, members mm WHERE recipientID = mm.id and username = ?";
$stm = $db->prepare($sql);
$stm->execute([$pageowner]);
$data = $stm->fetchAll();
?>
<?php foreach ($data as $row): ?>
<br><?=$row['title'] ?>
<?php endforeach ?>