0

I used the following answer in order to patch SQLi(How can I prevent SQL injection in PHP?), however, although the connection to the database is made, the pages are left blank, as if the data is not returned. Here's an example:

        public function getPlayerInfo($name){
        $stmt = $this->db->prepare("SELECT * FROM playerinfo WHERE PlayerName = ':name'"); 
        //$stmt->execute(); 
        return $stmt->execute(array('name' => $name)); } // I tried using this but it didnt work, information page is left blank
        return $stmt->fetchAll(PDO::FETCH_ASSOC); } // This one used to work before I applied the patch

I'm using the function in the player information page to display his information. How can I use it in order to return an array that can be read on that page via foreach?

Thanks!

Nutz
  • 79
  • 2
  • 11

1 Answers1

1

Remove single quotes around the placeholder :name, your prepared statement should be like this:

$stmt = $this->db->prepare("SELECT * FROM playerinfo WHERE PlayerName = :name");

Here's the complete getPlayerInfo() method,

public function getPlayerInfo($name){
    $stmt = $this->db->prepare("SELECT * FROM playerinfo WHERE PlayerName = :name"); 
    $stmt->execute(array('name' => $name));
    return $stmt->fetchAll(PDO::FETCH_ASSOC); 
}

This issue has already been documented here, http://php.net/manual/en/pdo.prepare.php#111458

Rajdeep Paul
  • 16,887
  • 3
  • 18
  • 37
  • pastebin.com/xSqEbWUp Tried using the following code, didn't work out either. Previously, only the div with the user info was blank, but now the entire page is blank as if there's a fatal error or something – Nutz Jul 02 '17 at 20:18
  • 1
    @Nutz A *blank* page means something is broken. Turn on error reproting, add these two lines `ini_set('display_errors', 1); error_reporting(E_ALL);` at very top of your PHP scripts and see if it yields any error or not. – Rajdeep Paul Jul 02 '17 at 20:21
  • Also worth mentioning that PHP developers should always watch for errors in their http error log. – Bill Karwin Jul 02 '17 at 20:35