ADOdb

Database Abstraction Layer for PHP

User Tools

Site Tools

Trace: • param
v5:reference:connection:param

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
v5:reference:connection:param [2020/01/25 00:30] – [Usage] full section rewrite with cleaner layout and more realistic example. dregadv5:reference:connection:param [2021/02/26 01:35] (current) – Call with falsy values: param(false) vs param(0) - see #682 dregad
Line 14: Line 14:
 This method is used with [[v5:userguide:learn_bind:bind_vars|bind variable SQL statement execution]], to produce injection resistant code. This method is used with [[v5:userguide:learn_bind:bind_vars|bind variable SQL statement execution]], to produce injection resistant code.
  
-On RDBMS with positional (numbered) query parameters such as PostgreSQL, calling ''param(false)'' will reset the parameter counter, allowing to start building a new query.+On RDBMS with positional (numbered) query parameters such as PostgreSQL, calling ''param()'' with a "falsy" value((equivalent to ''false''; read the //Converting to boolean// section in the [[https://www.php.net/manual/en/language.types.boolean.php|PHP manual]])) will reset the parameter counter, allowing to start building a new query without first executing the previous one. 
 + 
 +<WRAP tip> 
 +Note that calling ''param(false)'' **only** resets the counter, //without returning a placeholder//. This allows forcing a reset operation independently from building a query; the next invocation will return the first placeholder. 
 + 
 +Compare that with ''param(0)'' or ''param(%%''%%)'', which both resets **and** returns the first placeholder. 
 + 
 +This is illustrated in the examples below. 
 +</WRAP> 
 + 
  
 ------------------------------ ------------------------------
Line 22: Line 32:
  
 <code php> <code php>
-$sql1 = 'SELECT * FROM accounts WHERE name = ' . $db->param('account') . ' AND total = ' . $db->param('amount');+$sql1 = 'SELECT * FROM accounts WHERE '  
 +    . 'name = '  . $db->param('account') . ' AND ' 
 +    . 'total = ' . $db->param('amount'); 
 + 
 +// Reset param count as a standalone operation then build the query
 $db->param(false); $db->param(false);
 $sql2 = 'SELECT * FROM accounts WHERE id = ' . $db->param('id'); $sql2 = 'SELECT * FROM accounts WHERE id = ' . $db->param('id');
 +
 +// Reset param count with a "falsy" value while building the query
 +$sql3 = 'SELECT * FROM accounts WHERE '
 +    . 'name = ' . $db->param(0) . ' AND '
 +    . 'status = ' . $db->param(1);
 </code> </code>
 +
 +
  
 See below for the code's output with various database drivers. See below for the code's output with various database drivers.
Line 33: Line 54:
 $sql1: SELECT * FROM accounts WHERE name = ? AND total = ? $sql1: SELECT * FROM accounts WHERE name = ? AND total = ?
 $sql2: SELECT * FROM accounts WHERE id = ? $sql2: SELECT * FROM accounts WHERE id = ?
 +$sql3: SELECT * FROM accounts WHERE name = ? AND status = ?
 </code> </code>
  
Line 38: Line 60:
 <code> <code>
 $sql1: SELECT * FROM accounts WHERE name = :account AND total = :amount $sql1: SELECT * FROM accounts WHERE name = :account AND total = :amount
-$sql2: SELECT * FROM accounts WHERE id = :id"+$sql2: SELECT * FROM accounts WHERE id = :id 
 +$sql3: SELECT * FROM accounts WHERE name = :0 AND status = :1
 </code> </code>
  
Line 45: Line 68:
 $sql1: SELECT * FROM accounts WHERE name = $1 AND total = $2 $sql1: SELECT * FROM accounts WHERE name = $1 AND total = $2
 $sql2: SELECT * FROM accounts WHERE id = $1 $sql2: SELECT * FROM accounts WHERE id = $1
 +$sql3: SELECT * FROM accounts WHERE name = $1 AND status = $2
 </code> </code>
 +
 +Without the parameter reset, //$sql2// would be ''... id = $3'' and //$sql3// ''... name = $4 AND status = $5'', which would result in errors when calling [[v5:reference:connection:execute|]].
  
v5/reference/connection/param.1579908636.txt.gz · Last modified: by dregad