Optional LIMIT for a function grabbing all post with PDO - php

Question

I'm trying to create a function that will grab all posts within a table. I also wanted to add a optional LIMIT parameter. Here is an example:
function get_all_posts($conn, $limit = 0) {
if ($limit > 0) {
$stmt = $conn->prepare("SELECT * FROM posts LIMIT :limit");
$stmt->execute(array(
':limit' => $limit
));
$results = $stmt->fetchAll();
return $results ? $results : false ;
} else {
$stmt = $conn->prepare("SELECT * FROM posts");
$stmt->execute();
$results = $stmt->fetchAll();
return $results ? $results : false ;
}
}
If I call the function without using the limit parameter it works and displays all the posts. But if I call the function like this: get_all_posts($conn, "1"); Then I get this error:
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' at line 1' in /Applications/MAMP/htdocs/sandbox/blog2/functions.php:19 Stack trace: #0 /Applications/MAMP/htdocs/sandbox/blog2/functions.php(19): PDOStatement->execute(Array) #1 /Applications/MAMP/htdocs/sandbox/blog2/index.php(12): get_all_posts(Object(PDO), '1') #2 {main} thrown in /Applications/MAMP/htdocs/sandbox/blog2/functions.php on line 19
Can anyone show me where I've gone wrong?

Answer 1

1 is not a string, so don't put quotes around it here: get_all_posts($conn, 1);

Answer 2

By default PDO execute() treats parameters as a string. As such it is quoting "1". You will need to use bindParam().
Although MySQL may handle this, you should bind this parameter accordingly (as an INT). See this related question for more detail.

Answer 3

Like Sammitch said, its because its a string, not an integer. Use this to fix:
if (is_numeric($limit)) {
$limit = (int)$limit;
...
to clear any variable type issues

Answer 4

In the LIMIT clause you need an integer parameter.
In your code you pass the :limit' parameter's value viaexecute` which are all strings.
A string is not an integer. This mismatch creates your issue.
Instead bin the parameter as integer and you are fine.
$stmt = $conn->prepare("SELECT * FROM posts LIMIT :limit");
$stmt->bindParam(':limit', $limit, PDO::PARAM_INT);
$success = $stmt->execute();
$results = $stmt->fetchAll();
As you accept the $limit variable via a function parameter, you should sanitize it's value as well:
$limit = (int) $limit;
That will ensure you are using a variable of type integer when binding it as an integer parameter.