note 99025 modified in function.pg-query-params by danbrown

From: Date: Thu, 22 Jul 2010 19:05:17 +0000
Subject: note 99025 modified in function.pg-query-params by danbrown
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-171057@lists.php.net to get a copy of this message
Unfortunately the params will not respect string representations of NULL or NOW(). If your code pushes these values, they be considered a string and inserted literally as "NULL" and "NOW()". Ideally, there should be an additional parameter that you can assign to force this text as pgSQL functions/reserved words and not wrap them up as strings (assuming pgSQL's parameterized queries support this. This same problem also occurs for comma lists used in "WHERE column IN (1,2,3,4)", params treats "1,2,3,4" as a string, not a list of numbers, and runs it with quotes also. For debugging, I use this function to simulate params, keep in mind this is not 100% accurate, it only attempts to simulate the actual SQL that param queries create. <?php function pg_query_params_return_sql($query, $array) { $query_parsed = $query; for ($a = 0, $b = sizeof($array); $a < $b; $a++) { if ( is_numeric($array[$a]) ) { $query_parsed = str_replace(('$'.($a+1)), str_replace("'","''", $array[$a]), $query_parsed ); } else { $query_parsed = str_replace(('$'.($a+1)), "'".str_replace("'","''", $array[$a])."'", $query_parsed ); } } return $query_parsed; } ?> --was-- Unfortunately the params will not respect string representations of NULL or NOW(). If your code pushes these values, they be considered a string and inserted literally as "NULL" and "NOW()". Ideally, there should be an additional parameter that you can assign to force this text as pgSQL functions/reserved words and not wrap them up as strings (assuming pgSQL's parameterized queries support this. This same problem also occurs for comma lists used in "WHERE column IN (1,2,3,4)", params treats "1,2,3,4" as a string, not a list of numbers, and runs it with quotes also. For debugging, I use this function to simulate params, keep in mind this is not 100% accurate, it only attempts to simulate the actual SQL that param queries create. function pg_query_params_return_sql($query, $array) { $query_parsed = $query; for ($a = 0, $b = sizeof($array); $a < $b; $a++) { if ( is_numeric($array[$a]) ) { $query_parsed = str_replace(('$'.($a+1)), str_replace("'","''", $array[$a]), $query_parsed ); } else { $query_parsed = str_replace(('$'.($a+1)), "'".str_replace("'","''", $array[$a])."'", $query_parsed ); } } return $query_parsed; } http://php.net/manual/en/function.pg-query-params.php

« previous php.notes (#171057) next »