Prepared Statements - Search
| From: | Ethan Rosenberg, PhD | Date: | Mon, 03 Dec 2012 19:30:35 +0000 |
| Subject: | Prepared Statements - Search | ||
| Groups: | php.db | ||
| Request: | Send a blank email to php-db+get-48592@lists.php.net to get a copy of this message | ||
Dear List -
I am trying to use prepared statements with the following code:
$allowed_fields = array
('Cust_Num' => 'i', 'Fname' => 's', 'Lname' => 's', 'Street' => 's','City'=> 's', 'State' => 's', 'Zip' => 'i',
'Phone' => 'i', 'Notes' => 's'
);
if(empty($allowed_fields))
{
echo "ouch";
}
// Configure the query and the acceptable params to put into the WHERE clause
$sql12 = 'SELECT * FROM Customers WHERE 1';
// Magically put everything together
$types = '';
$args = array();
foreach( $allowed_fields as $k => $type )
{
if( !array_key_exists( $k, $allowed_fields ) )
continue;
else
{
if( ($_POST[$k]) != '')
{
$args[] = &$_POST[$k]; // Note the addition of the ampersand here
$types .= $type;
$sql12 .= " AND ($k = ?)";
}
}
}
$stmt = mysqli_stmt_init($cxn);
mysqli_stmt_prepare( $stmt, $sql12 );
The search fails.
This debug code:
echo "For debugging and demonstration #1<br />";
echo 'Query: ' . $sql12 . PHP_EOL;
echo 'Bind types: ' . $types . PHP_EOL;
echo "arguments<br />";
print_r($args);
gives the following results:
For debugging and demonstration #1
Query: SELECT * FROM Customers WHERE 1 AND (Fname = ?) AND (Lname = ?) AND (Street = ?) AND (City = ?) AND (State = ?) AND (Zip = ?) AND (Phone = ?)
Bind types: sssssii
arguments
Array
(
[0] =>
[1] =>
[2] =>
[3] =>
[4] =>
[5] =>
[6] => 845745745
)
If I search the database from the command line, these are the results -
mysql> select * from Customers where Phone=845745745;
+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+
| Cust_Num | Fname | Lname | Street | City | State | Zip | Phone | Date | Notes | P1 | P2 | P3 |+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+
| 10016 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY | 127 | 845745745 | 2012-12-01 | tvgfuyholkijuhy | NULL | NULL | NULL | | 10017 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY | 10952 | 845745745 | 2012-12-01 | tvgfuyholkijuhy | NULL | NULL | NULL | | 10018 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY | 32767 | 845745745 | 2012-12-02 | tvgfuyholkijuhy | NULL | NULL | NULL |+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+ 3 rows in set (0.00 sec) This is the output routine: if(count($errors_array) == 0) { ?> <center><b>Search Results</b></center><br /> <center> <table border="4" cellpadding="5" cellspacing="55" rules="all" frame="box" style="table-layout: fixed;"> <tr class="heading"> <th>Cust_Num</th> <th>First Name</th> <th>Last Name</th> <th>Street</th> <th>City</th> <th>State</th> <th>Zip</th> <th>Phone</th> <th>Notes</th>
<?php $i = 0;do { { $vara2 = array(array($Cust_Num, $Fname, $Lname, $Street, $City, $State, $Zip, $Phone, $Notes)); $vara2[$i][0] = $Cust_Num; $vara2[$i][1] = $Fname; $vara2[$i][2] = $Lname; $vara2[$i][3] = $Street; $vara2[$i][4] = $City; $vara2[$i][5] = $State; $vara2[$i][6] = $Zip; $vara2[$i][7] = $Phone; $vara2[$i][8] = Notes; $_SESSION['exe'] = 2; ?> <tr> <td> <?php echo $vara2[$i][0]?> </td> <td> <?php echo $vara2[$i][1]?> </td> <td> <?php echo $vara2[$i][2]?> </td> <td> <?php echo $vara2[$i][3]?> </td> <td> <?php echo $vara2[$i][4]?> </td> <td> <?php echo $vara2[$i][5]?> </td> <td> <?php echo $vara2[$i][6]?> </td> <td> <?php echo $vara2[$i][7]?> </td> <td class="first-col"><?php echo $vara2[$i][8] ?></td> <?php echo "</tr>\n"; $i = $i + 1; } } while (mysqli_stmt_fetch($stmt)); //end do-while $imax = $i; echo "</table>"; echo "</center>"; echo "</form>"; Help and advice, please. Ethan