#23865 [Opn->Csd]: Parametric Queries, and Parametric Stored Procedures in Postgres

ID: 23865 Updated by: chriskl@php.net Reported By: rcphp at littondale dot dyndns dot org -Status: Open +Status: Closed Bug Type: Feature/Change Request Operating System: Linux (Debian Unstable) PHP Version: 4.3.1 -Assigned To: +Assigned To: chriskl New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. - Added several new functions to support the PostgreSQL v3 protocol introduced in PostgreSQL 7.4. (Christopher) . pg_transaction_status() - in-transaction status of a database connection. . pg_query_params() - execution of parameterized queries. . pg_prepare() - prepare named queries. . pg_execute() - execution of named prepared queries. . pg_send_query_params() - async equivalent of pg_query_params(). . pg_send_prepare() - async equivalent of pg_prepare(). . pg_send_execute() - async equivalent of pg_execute(). . pg_result_error_field() - highly detailed error information, most importantly the SQLSTATE error code. Previous Comments: ------------------------------------------------------------------------ [2003-05-28 16:06:11] rcphp at littondale dot dyndns dot org Feature reqeuest for parametric queries, SQL bind variables, parameterised procedure calls, or whatever people call them ;-) For example pg_query("UPDATE Wibble SET foo=? WHERE wombat=?", $newFoo, $wombat); pg_exec("spAddComment(?,?,?)",$user,$title,$content); A notable feature of these is no need to build dynamic SQL, and remember to addslashes(). Security becomes easier, and if prepared statements can be reused, speed can become better. $stmt = pg_prepare("INSERT INTO Events (date,msg) VALUES (?,?)"); pg_execute($stmt,date(),"Wotzit Flobbled"); ... pg_execute($stmt,date(),"Slime Thoroughly Slaughtered"); (Does PHP have varargs by the way?) Some finer details to sort, due to the way different database backends work. Postgres has stored procedures, but it looks like you SELECT from them, and they behave like functions in other databases. Otherwise though, a good language. - Richard ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=23865&edit=1