note 99025 modified in function.pg-query-params by danbrown
| From: | danbrown@php.net | Date: | Thu, 22 Jul 2010 19:05:17 +0000 |
| Subject: | note 99025 modified in function.pg-query-params by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-171057@lists.php.net to get a copy of this message | ||
Unfortunately the params will not respect string representations of NULL or NOW(). If your code
pushes these values, they be considered a string and inserted literally as "NULL" and
"NOW()".
Ideally, there should be an additional parameter that you can assign to force this text as pgSQL
functions/reserved words and not wrap them up as strings (assuming pgSQL's parameterized
queries support this.
This same problem also occurs for comma lists used in "WHERE column IN (1,2,3,4)", params
treats "1,2,3,4" as a string, not a list of numbers, and runs it with quotes also.
For debugging, I use this function to simulate params, keep in mind this is not 100% accurate, it
only attempts to simulate the actual SQL that param queries create.
<?php
function pg_query_params_return_sql($query, $array)
{
$query_parsed = $query;
for ($a = 0, $b = sizeof($array); $a < $b; $a++)
{
if ( is_numeric($array[$a]) )
{
$query_parsed = str_replace(('$'.($a+1)),
str_replace("'","''", $array[$a]), $query_parsed );
}
else
{
$query_parsed = str_replace(('$'.($a+1)),
"'".str_replace("'","''",
$array[$a])."'", $query_parsed );
}
}
return $query_parsed;
}
?>
--was--
Unfortunately the params will not respect string representations of NULL or NOW(). If your code
pushes these values, they be considered a string and inserted literally as "NULL" and
"NOW()".
Ideally, there should be an additional parameter that you can assign to force this text as pgSQL
functions/reserved words and not wrap them up as strings (assuming pgSQL's parameterized
queries support this.
This same problem also occurs for comma lists used in "WHERE column IN (1,2,3,4)", params
treats "1,2,3,4" as a string, not a list of numbers, and runs it with quotes also.
For debugging, I use this function to simulate params, keep in mind this is not 100% accurate, it
only attempts to simulate the actual SQL that param queries create.
function pg_query_params_return_sql($query, $array)
{
$query_parsed = $query;
for ($a = 0, $b = sizeof($array); $a < $b; $a++)
{
if ( is_numeric($array[$a]) )
{
$query_parsed = str_replace(('$'.($a+1)),
str_replace("'","''", $array[$a]), $query_parsed );
}
else
{
$query_parsed = str_replace(('$'.($a+1)),
"'".str_replace("'","''",
$array[$a])."'", $query_parsed );
}
}
return $query_parsed;
}
http://php.net/manual/en/function.pg-query-params.php