I want to insert the time of user's registration:
function InsertUserToSql()
...
$stmt = $this->dbh->prepare("INSERT INTO users
(username, password, email, regdate) VALUES
(:username,:password, :email, :regdate)");
$stmt->bindParam(':username', $this->Username);
$stmt->bindParam(':password', $this->Password);
$stmt->bindParam(':email', $this->Email);
$stmt->bindParam(':regdate', time()); // this line shows the error
$stmt->execute();
...
Error: Strict standards: Only variables should be passed by reference
$stmt = $this->dbh->prepare("INSERT INTO users
(username, password, email, regdate) VALUES
(:username,:password, :email, UNIX_TIMESTAMP())");
as for the error message - it's pretty googlable.
Related
I'm trying to insert data to database but i always get error
What I'm doing wrong?
// Enter the new user in the database
$sql = "INSERT INTO policajt (meno, priezvisko, cislo_odznaku) VALUES (:fname, :lname, :co)";
$stmt = $conn->prepare($sql);
$sql = "INSERT INTO users (policajt_id, username, heslo) VALUES (LAST_INSERT_ID(), :username, :password)";
$stmt = $conn->prepare($sql);
$stmt->bindParam(':fname', $_POST['fname'], PDO::PARAM_STR);
$stmt->bindParam(':lname', $_POST['lname'], PDO::PARAM_STR);
$stmt->bindParam(':co', $_POST['co'], PDO::PARAM_STR);
$stmt->bindParam(':username', $_POST['username'], PDO::PARAM_STR);
$password = password_hash($_POST['password'], PASSWORD_BCRYPT);
$stmt->bindParam(':password', $password, PDO::PARAM_STR);
if( $stmt->execute()):
$message = 'Successfully created new user';
else:
$message = 'Sorry there must have been an issue creating your account';
endif;
When I run code, I get this error:
Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter
number: number of bound variables does not match number of tokens
Any help would be greatly appreciated. Thank you in advance!
In your insert statement you are not specifying the tokens for all fields that you want to do an insert for.
INSERT INTO policajt (meno, priezvisko, cislo_odznaku) VALUES (:fname, :lname, :co)
should be
INSERT INTO policajt (meno, priezvisko, cislo_odznaku) VALUES (:meno, :fname, :lname, :co)
Have seen tons of similar questions but still can't find out what's going on.
I'm using PHP's PDO to prepare a statement like that:
try{
$statement = $db->prepare("INSERT INTO $date (name, surname, email, phone, comment) VALUES (:name, :surname, :email, :phone, :comment)");
$statement->bindParam(':name', $name);
$statement->bindParam(':surname', $surname);
$statement->bindParam(':email', $email);
$statement->bindParam(':phone', $phone);
$statement->bindParam(':comment', $comment);
$statement->execute();
}
catch(PDOException $e){
die("Connection to database failed: " . $e->getMessage());
}
Have tried escaping everything with [] and specifying the database name before table name, but keep getting
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in
your SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near '2017-08-11 (name, surname, email,
phone, comment) VALUES ('Test', 'Test', 'Test#' at line 1
INSERT INTO $date
It seems that there is a 2017-08-11 in $date var.
If you want to insert data into '2017-08-11' table, it should be escaped with ` symbol
try{
$statement = $db->prepare("INSERT INTO `$date` (name, surname, email, phone, comment) VALUES (:name, :surname, :email, :phone, :comment)");
$statement->bindParam(':name', $name);
$statement->bindParam(':surname', $surname);
$statement->bindParam(':email', $email);
$statement->bindParam(':phone', $phone);
$statement->bindParam(':comment', $comment);
$statement->execute();
}
catch(PDOException $e){
die("Connection to database failed: " . $e->getMessage());
}
Assuming that 2017-08-11 is a table name, simply encase it in backticks.
$statement = $db->prepare("INSERT INTO `$date` (name, surname, email, phone, comment) VALUES (:name, :surname, :email, :phone, :comment)");
sorry but you can't use special character when using the prepare statement, so what MySQL is actually seeing is INSERT INTO $date (name, surname, email, phone, comment) VALUES (:name, :surname, :email, :phone, :comment) which will trigger a syntax error.
here is a quick solution
try{
$db->query("INSERT INTO $date (name, surname, email, phone, comment) VALUES ($name, $surname, $email, $phone, $comment)");
}
catch(PDOException $e){
die("Connection to database failed: " . $e->getMessage());
}
I am trying to run the following in PHP:
$stmt = $db_con->prepare("SELECT * FROM users WHERE email=:email");
$stmt->execute(array(":email"=>$user_email));
$count = $stmt->rowCount();
if($count==0){
$stmt = $db_con->prepare("INSERT INTO users(username,email,password,ip)VALUES(:uname, :email, :password, :ip)");
$stmt->bindParam(":username",$username);
$stmt->bindParam(":email",$useremail);
$stmt->bindParam(":password",$hasheduserpassword);
$stmt->bindParam(":ip",$userip);
As a result, I get the following error:
SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
In the query you are defining uname while setting a parameter called username
try
$stmt = $db_con->prepare("INSERT INTO users(username,email,password,ip)VALUES(:username, :email, :password, :ip)");
Your error lies here
$stmt = $db_con->prepare("INSERT INTO users(username,email,password,ip)VALUES(:uname, :email, :password, :ip)");
// $stmt->bindParam(":username",$username);// this shoud be uname
$stmt->bindParam(":uname",$username);
Error is here:
VALUES(:uname,
$stmt->bindParam(":username",$username);
MySql is looking for :username but it cannot find it because you named it :uname.
Both must match.
I have a User class and I'm wondering what would be the "most recommended" way to handle insertions?
Option 1: Use an existing object
// insert a new user and return the user id
public function insert() {
$sql = "INSERT INTO users (username, password, email, avatar, subscribe, created, last_login, valid) VALUES
(?, ?, ?, ?, ?, ?, ?, ?)";
$sth = $this->db->prepare($sql);
$sth->bindParam(1, $this->username, PDO::PARAM_STR);
$sth->bindParam(2, $this->password, PDO::PARAM_STR);
$sth->bindParam(3, $this->email, PDO::PARAM_STR);
$sth->bindParam(4, $this->avatar, PDO::PARAM_STR);
$sth->bindParam(5, $this->subscribe, PDO::PARAM_STR);
$sth->bindParam(6, $this->created, PDO::PARAM_STR);
$sth->bindParam(7, $this->last_login, PDO::PARAM_STR);
$sth->bindParam(8, $this->valid, PDO::PARAM_STR);
$sth->execute();
return $this->db->lastInsertId();
}
Option 2: Pass the information in as an array
// insert a new user and return the user id
public function insert(array $fields = array()) {
if(!empty($fields)) {
$sql = "INSERT INTO users (username, password, email, avatar, subscribe, created, last_login, valid) VALUES
(:username, :password, :email, :avatar, :subscribe, :created, :last_login, :valid)";
$sth = $this->db->prepare($sql);
$sth->execute($fields);
return $this->db->lastInsertId();
}
}
Another option? Does it make any difference?
Both ways are okay but personally I suggest second option
I just to need make sure I've got the PDO prepare statements correctly, will the following code be secured by SQL Injection?
$data['username'] = $username;
$data['password'] = $password;
$data['salt'] = $this->generate_salt();
$data['email'] = $email;
$sth = $this->db->prepare("INSERT INTO `user` (username, password, salt, email, created) VALUES (:username, :password, :salt, :email, NOW())");
$sth->execute($data);
Yes, your code is safe. It can be shortened however:
$data = array( $username, $password, $this->generate_salt(), $email );
// If you don't want to do anything with the returned value:
$this->db->prepare("
INSERT INTO `user` (username, password, salt, email, created)
VALUES (?, ?, ?, ?, NOW())
")->execute($data);
You could start with an empty array for your $data like
// start with an fresh array for data
$data = array();
// imagine your code here
Your code looks good so far.
EDIT: I missed your NOW() call. Imho you should add it with a bind variable as well, like
// bind date
$data['created'] = date("Y-m-d H:i:s");
// updated prepare statement
$sth = $this->db->prepare("INSERT INTO `user` (username, password, salt, email, created) VALUES (:username, :password, :salt, :email, :created)");