Migrating MySQL code to PDO [closed] - php

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist
Closed 9 years ago.
Improve this question
I am new to PDO and am attempting to convert my existing PHP/MYSQL code to meet PDO standards.
The problem i am having is I can connect to the database but no results are being shown and no errors are being displayed.
This is my database:
$db2 = new PDO('mysql:host=localhost;dbname=DATABASENAME;charset=utf8', 'USERNAME', 'PASSWORD');
$db2->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db2->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
I am using
include 'db.php';
to include the above database details in my main PHP script.
My main script using the following as a select statement to display the rows which match the criteria:
<?
foreach($db2->query('SELECT view_invoice FROM user_info where username = "$timeapp_username"') as $inrow) {
$inrow['view_invoice']; //etc...
}
?>
On running this I get no errors but no results displayed. I cannot spot what I am doing wrong. Can anyone advise what I am doing wrong here?

Answer 1

The query function is unsafe and should be used only for queries that will not return data, like UPDATE, DELETE, INSERT...
To make safe and working SELECT queries, prepare your query with the PDOStatement. See:
//Example querystring
$id = $_GET['id'];
try{
//Instantiate PDO
$pdo = new PDO('dsn', 'user', 'password');
//Create the statement
$statement = $pdo->prepare("SELECT * FROM `my_table` WHERE `id`=:id");
//Now you can bind values to the statement. This will automatically escape the values
//Defines the type of the value that you'll bind (optional)
$data_type = (is_numeric($id)) ? PDO::PARAM_INT : PDO::PARAM_STR;
//Replace the :id in the query by the value retrieved from the querystring
$statement->bindValue(':id', $id, $data_type);
//Now, let's execute our statement
$statement->execute();
//If the query has returned any rows, we can iterate over it
if ($statement->rowCount() > 0)
{
foreach ($statement->fetchAll() as $result)
{
//Now you can retrieve the values using the defined fetch method.
//Example with associative fetch mode:
echo 'My name is '.$result['name']."!";
echo '<br />';
}
}
else
{
//No results found
}
} catch (PDOException $pe){
die("An error has occurred: ".$pe->getMessage());
}