Re: Prepared Statements

On Fri, Nov 11, 2011 at 10:41 AM, Ron Piggott <ron.piggott@actsministries.org> wrote: > <?php > > $dsh = 'mysql:host=localhost;dbname='.$database; > $dbh = new PDO($dsh, $username, $password); > > #query for the authorization code > > $query = "SELECT authorization_code FROM > directory_listing_update_authorizations WHERE NOW() BETWEEN > start_date AND end_date AND €Ô §_¶ð( > ©Ëò6IðÞauthorization_code = :authorization_code AND > directory_entries_reference = :directory_entries_reference LIMIT > 1;"; > > $stmt = $dbh->prepare($query); > > $stmt->bindValue(':directory_entries_reference', $directory_entries_reference, > PDO::PARAM_STR); > $stmt->bindValue(':authorization_code', $authorization_code, PDO::PARAM_STR); > > $stmt->execute() or die(print_r($stmt->errorInfo(), true)); > > while ($row = $stmt->fetch()) { Not entirely clear here why you need a while statement if your query above is limit 1. > >    if ( $row['authorization_code'] == $authorization_code ) { This is redundant with the query statement above; given that, this will always pass. >        #update directory_entries.last_review with today's date > >        $query = "UPDATE directory_entries SET > last_review = NOW() WHERE reference > = :directory_entries_reference LIMIT 1;"; > >        $stmt = $dbh->prepare($query); This concerns me -- the outer loop is using the previously prepared and exectued statement in the $stmt variable, then you're resetting it here. This probably works because your initial query was limit 1, but it might not in another context. Regardless, it makes the outer while loop test invalid. > >        $stmt->bindValue(':directory_entries_reference', > $directory_entries_reference, PDO::PARAM_STR); > >        $stmt->execute() or die(print_r($stmt->errorInfo(), true)); > >    } else { > >        #failure, direct user to request new authorization code or login manually > >    } > > }