How to bind post variables

Question

just a quick question about binding in php

I know if you do something like

$select = update my_table set name ='".$posted_name.'" where id=1;

and that is subjected to sql injection

but how will you bind the query below

$select = update my_table set name ='".$posted_name[$a].'" where id=1;

IN my bind array this is how I am binding anything without [$a]

for any example with the first statement I am doing

   $select = update my_table set name =:p_update_name where id=1;

   $bind_update = array('p_update_name' => $t_update_name);

@SureshKamrushi so in PDO you will do $stmt->bindParam(1, $name[$a]);? — Henry
– Henry, Commented Nov 25, 2013 at 13:25
thanks @YourCommonSense but it doesn't show the a method with $posted_name[$a]. it just includes a standard statement. — Henry
– Henry, Commented Nov 25, 2013 at 13:31
method with $posted_name[$a] has absolutely nothing to do with prepared statements — Your Common Sense
– Your Common Sense, Commented Nov 25, 2013 at 13:32

Suresh Kamrushi · Accepted Answer · 2013-11-25 13:26:16Z

1

Try like this:

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (?, ?)");
$stmt->bindParam(1, $name);
$stmt->bindParam(2, $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

answered Nov 25, 2013 at 13:26

Suresh Kamrushi

16.2k13 gold badges79 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Henry Over a year ago

can you try and cover both pdo and mysqli method in your answer please. thanks

Your Common Sense · Accepted Answer · 2013-11-25 13:46:18Z

0

you don't have to make all the names equal.

$select = "update my_table set name =:whatever where id=1";
$bind_update = array('whatever' => $random_variable);

will do. so it can be any variable you can think of. As long as it's scalar variable though

edited Nov 25, 2013 at 13:46

answered Nov 25, 2013 at 13:31

Your Common Sense

158k42 gold badges226 silver badges372 bronze badges

5 Comments

Henry Over a year ago

what about the [$a] wouldnt i need to include that in the statement or the binding?

Henry Over a year ago

ok I see your answer, so basically the way you are binding $select = update my_table set name ='".$posted_name[$a].'" where id=1; is the same as $select = update my_table set name ='".$posted_name.'" where id=1;

Your Common Sense Over a year ago

There is no binding in your example

Henry Over a year ago

sorry for the late reply. I updated my question to show how I am binding, i am using array binding(oracle) but its query is no different and the function that was written is in php.

Your Common Sense Over a year ago

All I can do is only repeat what I said before: there is absolutely no reason for the variables have the same name with placeholders.

Collectives™ on Stack Overflow

How to bind post variables

2 Answers 2

1 Comment

5 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

5 Comments

Linked

Related