-1

So I have two questions.

Question 1:

My select statement returns 2 items. However, I have to while loop through the items it returns to append the results into a single array called $results. Is there a function which already returns the data as one single array (same/similar to how the output is right now, but minus the while loop).

select-statement-code.php

$stid = oci_parse($conn, "SELECT *
                          FROM test_table");

oci_execute($stid);

while($row=oci_fetch_array($stid)) {
    $results[] = $row;
}

print_r($results);

The output is:

Array
(
    [0] => Array
        (
            [0] => 1
            [MY_ID] => 1
            [1] => John
            [F_NAME] => John
        )

    [1] => Array
        (
            [0] => 2
            [MY_ID] => 2
            [1] => Mike
            [F_NAME] => Mike
        )

)

Question 2:

I've been reading over stackoverflow answers and there are multiple different answer which are conflicting each other. There is a clear cut answer for mysqli, but for oracle, it seems people argue about it. Is the way I am doing it below, the proper way to eliminate SQL injection? Also I used the oci_bind_by_name function 2 times, to bind the my_id and f_name. Is there a way to call the bind function once and bind both variables?

insert-statement.php

$my_id = 3; // Pretend this is an input from a random user, using my website
$name = "Bobby"; // Pretend this is an input from a random user, using my website

$sql = "INSERT INTO test_table (my_id, f_name) 
        VALUES (:id, :f_name)";
$stid = oci_parse($conn, $sql);
oci_bind_by_name($stid, ":id", $my_id);
oci_bind_by_name($stid, ":f_name", $name);
oci_execute($stid);
William Robertson
  • 15,273
  • 4
  • 38
  • 44
Ross
  • 95
  • 1
  • 10
  • 1
    For future reference, two questions should two questions, that is two separate posts. – APC Mar 31 '19 at 06:46

1 Answers1

1

Q1. use oci_fetch_all:

$num_rows = oci_fetch_all($stid, $results);

Q2.

a. Yes, that's the correct way to prevent injection. See this Q&A for more details.
b. No, you have to call oci_bind_by_name once for each variable.

Nick
  • 138,499
  • 22
  • 57
  • 95
  • Quick question in regards to Question 1. `$results` returns the attributes as, all the `MY_ID`'s then all the `F_NAME`'s. Is there a way to do it, so it returns the array where one object is the row. Then the next object is the next row? – Ross Mar 31 '19 at 05:24
  • 1
    @Ross you need to add the `OCI_FETCHSTATEMENT_BY_ROW` flag to the call. See the second example on the manual page. – Nick Mar 31 '19 at 05:26