php - not loading variable into the database

Question

I have a database table - serial (autoincrement primary key), version, and turk_number. I am using the following code to insert a new row. I am receiving these variables via $_GET and I did a printout so I know that the variables are available, so I'm not sure whats wrong. The serial and version are loaded in, but not the turk_number.

$turk_number ='';
$serial='';
$version='';
if(isset($_GET['serial']))
{
    $serial=$_GET['serial'];
    $_SESSION['serial'] = $serial;
}
if(isset($_GET['version']))
{
    $version = $_GET['version'];
    $_SESSION['version'] = $version;
    print "version=" . $version;
}
if(isset($_GET['turk_number']))
{
    $turk_number= $_GET['turk_number'];
    $_SESSION['turk_number'] = $turk_number;
    print "turk number=".$turk_number;
}

//this assigns a participant a unique serial id at the beginning of the game
$hostname = "localhost";
$username = "root";
$password = "";
$dbname = "resolver";

try 
{
print 'turk2=' . $turk_number;
    $dbh = new PDO("mysql:host=$hostname;dbname=$dbname", $username, $password);

    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $query2 = "INSERT INTO participants (version, turk_number) VALUES (:version, :turk_number)";
        $stmt = $dbh ->prepare($query2);
        $stmt ->execute(array(':version' => $version,
                            ':turk_number' => $turk_number));

}
catch(PDOException $e)
{
    echo $e->getMessage();
}

No error, just getting a 0 in the turk_number column in the table — user1015214, Feb 17 '13 at 19:08
What is `print "turk number=".$turk_number;` giving you then? — Pekka, Feb 17 '13 at 19:10
thats giving me the correct turk number (in my example, it was ddddd)! Thats why I am confused. — user1015214, Feb 17 '13 at 19:12
Can you move that line to right before the PDO call? Just to make sure. — Pekka, Feb 17 '13 at 19:14
And `version` works? Weird. What type is your turk field? You're not trying to insert a non-int value into an int field, are you? — Pekka, Feb 17 '13 at 19:23
Oh, that was very silly! Yes, its an int field. I had set it as INT until I heard back from the client if it was supposed to be int or alphanumeric and forgot all about that. Thanks!] — user1015214, Feb 17 '13 at 19:31

score -1 · Accepted Answer · answered Feb 17 '13 at 19:03

-1

You forgot the quotes.

Change:

$query2 = "INSERT INTO participants (version, turk_number) VALUES (:version, :turk_number)";

to:

$query2 = "INSERT INTO participants (version, turk_number) VALUES (':version', ':turk_number')";

answered Feb 17 '13 at 19:03

Nir Alfasi

53,191
11
86
129

2

You don't need quotes, thats the way PDO class works, isn't it? http://www.phpeveryday.com/articles/PDO-Insert-and-Update-Statement-Use-Prepared-Statement-P552.html – user1015214 Feb 17 '13 at 19:07
Yeah, no quotes necessary here – Pekka Feb 17 '13 at 19:10
My suspicion is that since you don't use `$stmt->bindParam(2, $turk_number, PDO::PARAM_STR)` (you don't "tell" the statement that it's a string) and you assign it without the quotes, it translates into an INT. But that's just a guess, you may be right and it's something else. – Nir Alfasi Feb 17 '13 at 19:19
But I just tried a turk of 55555 and it did go into the database! Why was my code wrong and how exactly do you use bindParam? – user1015214 Feb 17 '13 at 19:24
In the example you posted they insert two strings, here you insert an INT and then a string. Again, I'm not sure, but since there are so many bugs in PHP... http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/ – Nir Alfasi Feb 17 '13 at 19:26
Another good thing you get out of using `bind_param` - it prevents sql-injection! – Nir Alfasi Feb 17 '13 at 19:27
1

I'll look up the manuals... But regarding your last point - I thought that the 'prepare' statement in PDO itself stopped sql injection. – user1015214 Feb 17 '13 at 19:29
@user1015214 no it won't necessarily (it'll prevent 1st order injection but not 2nd order): http://stackoverflow.com/a/134138/1057429 – Nir Alfasi Feb 17 '13 at 19:40

php - not loading variable into the database

1 Answers1