php pdo: prepare() does not execute but query() does [foreach loop] - php

Question

I'm not sure if the issue is with the prepare() statement itself or with the bindValues, but I cannot figure out why this works as a query() and not as a prepared statement.
$dbh = new PDO("mysql:host=$dbhost", $dbuser, $dbpass, $options);
$dbh->beginTransaction();
$record_data = $dbh->prepare("UPDATE $db.$dbt SET :column = :value WHERE `key` = :key;");
foreach ( $qaPairs as $pair ) {
list($question , $answer) = explode('=', $pair);
echo "$key : $question $answer";
$record_data->bindValue(':column', $question);
$record_data->bindValue(':value', $answer);
$record_data->bindValue(':key', $key);
$record_data->execute();
}
$dbh->commit();
If I replace the $record_data->bindValue…s and the $record_data->execute() with
$dbh->query("UPDATE `$db`.`$dbt` SET `$question`='$answer' WHERE `key`='$key';");
it works.
For troubleshooting, I added the echo statement, and the values printed are just letters and digits and no quoting; also, the database and table names are not quoted/tick'd.
I read in another question that looping causes problems with prepare and bind_. I switched from bindParam to bindValue, but that didn't seem to help…
EDIT: results of var_dump($key,$question,$answer):
string(17) "m3dc78db1e8368428" string(3) "age" string(2) "23" age 23

Answer 1

You cannot bind a table field name. As much as you cannot bind a table name. You'll have to use this code instead:
$dbh = new PDO("mysql:host=$dbhost", $dbuser, $dbpass, $options);
$dbh->beginTransaction();
foreach ( $qaPairs as $pair ) {
list($question , $answer) = explode('=', $pair);
// Initialize $column here… remember to sanitize it!!!
$record_data = $dbh->prepare("UPDATE $db.$dbt SET $question = :value WHERE `key` = :key;");
echo "$key : $question $answer";
$record_data->bindValue(':value', $answer);
$record_data->bindValue(':key', $key);
$record_data->execute();
}
$dbh->commit();
Reference:
Comment on PHP pdo.prepare.php

Answer 2

Did you change the error mode to 'exception' and used try/catch to display possible errors?
Here is how you do it:
<?php
$dbh = new PDO("mysql:host=$dbhost", $dbuser, $dbpass, $options);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
try {
$dbh->beginTransaction();
$record_data = $dbh->prepare("UPDATE $db.$dbt SET :column = :value WHERE `key` = :key;");
foreach ( $qaPairs as $pair ) {
list($question , $answer) = explode('=', $pair);
echo "$key : $question $answer";
$record_data->bindParam(':column', $question);
$record_data->bindParam(':value', $answer);
$record_data->bindParam(':key', $key);
$record_data->execute();
}
$dbh->commit();
} catch(PDOException $e) {
echo $e;
}
?>
I hope this step provides you with more insight.
Furthermore you need to use bindParam(), because the values of the variables are changing on each iteration.

Answer 3

final code:
error_reporting(-1);
$dbh = new PDO("mysql:host=$dbhost", $dbuser, $dbpass, $options);
$dbh->beginTransaction();
foreach ( $qaPairs as $pair ) {
list($question , $answer) = explode('=', $pair);
//var_dump($key,$question,$answer);
try {
$record_data = $dbh->prepare("UPDATE $db.$dbt SET $question = :value WHERE `key` = :key;");
//$record_data->bindParam(':column', $question);
$record_data->bindParam(':value', $answer);
$record_data->bindParam(':key', $key);
//$dbh->query("UPDATE `$db`.`$dbt` SET `$question`='$answer' WHERE `key`='$key';");
//$record_data->execute(array(1=>$question,2=>$answer,3=>$key));
//$record_data->execute(array(':column'=>$question,':value'=>$answer,':key'=>$key));
$record_data->execute();
}
catch(PDOException $e) {
echo $e;
}
}