note 119956 added to pdostatement.bindvalue
| From: | sageptr at gmail dot com | Date: | Wed, 28 Sep 2016 03:32:40 +0000 |
| Subject: | note 119956 added to pdostatement.bindvalue | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-206690@lists.php.net to get a copy of this message | ||
Be careful in edge cases!
With MySQL native prepares your integer can be wrapped around on some machines:
<?php
$x = 2147483648;
var_dump($x); // prints: int(2147483648)
$s = $db->prepare('SELECT :int AS I, :str AS S;');
$s->bindValue(':int', $x, PDO::PARAM_INT);
$s->bindValue(':str', $x, PDO::PARAM_STR);
$s->execute();
var_dump( $s->fetchAll(PDO::FETCH_ASSOC) );
/* prints: array(2) {
["I"]=>
string(11) "-2147483648"
["S"]=>
string(10) "2147483648"
} */
?>
Also, trying to bind PDO::PARAM_BOOL in MySQL with native prepares can make your query silently fail
and return empty set.
Emulated prepares work more stable in this cases, because they convert everything to strings and
just decide whenever to quote argument or not to quote.
----
Server IP: 72.52.91.14
Probable Submitter: 178.210.14.250
----
Manual Page -- http://php.net/manual/en/pdostatement.bindvalue.php
Edit -- https://master.php.net/note/edit/119956
Del: integrated -- https://master.php.net/note/delete/119956/integrated
Del: useless -- https://master.php.net/note/delete/119956/useless
Del: bad code -- https://master.php.net/note/delete/119956/bad+code
Del: spam -- https://master.php.net/note/delete/119956/spam
Del: non-english -- https://master.php.net/note/delete/119956/non-english
Del: in docs -- https://master.php.net/note/delete/119956/in+docs
Del: other reasons-- https://master.php.net/note/delete/119956
Reject -- https://master.php.net/note/reject/119956
Search -- https://master.php.net/manage/user-notes.php