Mysql PDO prepare to execute count (PHP)

Question

Current I'm trying to query a COUNT(*) using user input, so I want to prepare it, but when I do it there are no response, also I made using this: Row count with PDO as example, (prepare and query) but they both seems to doesn't work. Why? theres no reason...

$count = $con->query("SELECT COUNT(*) FROM $table WHERE senha='$senha' AND var='{$ar[$i]}'")->fetchColumn();
    if($count!=0){
        $q = $con->prepare("UPDATE $table SET value=':value' WHERE senha=':senha' AND var=':var'");
        $q->execute(array(':senha' => $senha, ':value' => $ar[$i+1], ':var' => $ar[$i]));
    }else{
        $q = $con->prepare("INSERT INTO $table (id,senha,var,value) VALUES (NULL, ':senha', ':var', ':value')");
        $q->execute(array(':senha' => $senha, ':var' => $ar[$i], ':value' => $ar[$i+1]));
    }

When I were using his first example (using prepare not query passing values using array) didn't work at all, the query one return a number but does not work the if (update or insert) part I've tried a bunch of things and outputs, nothing worked...

mask8 · Accepted Answer · 2012-07-22 01:07:46Z

3

You should not include single quote when you use parameters bind with PDO. so correct your UPDATE and INSERT query to followings:

$q = $con->prepare("UPDATE $table SET value=:value WHERE senha=:senha AND var=:var");

and

$q = $con->prepare("INSERT INTO $table (id,senha,var,value) VALUES (NULL, :senha, :var, :value)");

answered Jul 22, 2012 at 1:07

mask8

3,64827 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Pedro Gabriel Over a year ago

Without single quotes they can use # or -- how to prevent this?

mask8 Over a year ago

That will be taking care by PDO. That's the one of purpose of using PDO parameter bind actually :)

Pedro Gabriel Over a year ago

Weird, when I tried it seems to be commented hm, I'll try again. Thanks for answer (Accepted cause makes sense...)

mask8 Over a year ago

you're welcome. please update here if you have any issue with it. I will try to answer

mask8 Over a year ago

What values for the queries do you exactly have? The parameters should filter those any special characters for SQL. I wonder if you are having a problem with the first SELECT query? It isn't using parameters thus you need to sanitize values

|

Collectives™ on Stack Overflow

Mysql PDO prepare to execute count (PHP)

1 Answer 1

8 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Linked

Related