21

Ok, this is the problem:

This works:

$STH = $DBH->prepare("SELECT * FROM juegos WHERE id = 1");
$STH->execute();

This doesn't:

$STH = $DBH->prepare("SELECT * FROM juegos WHERE id = :id");
$STH->bindParam(':id', '1', PDO::PARAM_STR);
$STH->execute();

What in the world am I doing wrong? It doesn't even throw an exception

Thank you everyone!

Also, this is the whole code

<?php
    try {
        $DBH = new PDO("everything is", "ok", "here");

        $DBH->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );

        $STH = $DBH->prepare("SELECT * FROM juegos WHERE id = :id");
        $STH->bindParam(':id', '1', PDO::PARAM_STR);
        $STH->execute();

        $STH->setFetchMode(PDO::FETCH_ASSOC);

        while($row = $STH->fetch()) {
            echo $row['nombre']."<br/>";
        }

        $DBH = null;

        echo "Todo salió bien";

    } catch (PDOException $e) {
        echo "Error";
    }

?>
3
  • I "can" or I "can't", because this doesn't work either: $STH = $DBH->prepare("SELECT nombre FROM juegos WHERE id = :id"); $STH->bindParam(':id', 1, PDO::PARAM_INT); $STH->execute();
    – arielnmz
    Nov 11, 2013 at 8:49
  • You can not use parameters on table names. Sorry, that was a typo
    – juergen d
    Nov 11, 2013 at 8:50
  • The second parameter of bindParam must be a reference. you cant directly pass the value 1. As an alternative, try bindValue.
    – sofl
    Nov 11, 2013 at 9:02

5 Answers 5

28

Using bindParam() the variable is bound as a reference.

A string can't be passed by reference.

The following things can be passed by reference:

Variables, i.e. foo($a)

New statements, i.e. foo(new foobar())

References returned from functions

Try using bindValue()

$STH->bindValue(':id', '1', PDO::PARAM_STR);
1
  • Perfect to do dynamic WHEREs ;)
    – boctulus
    Jan 5, 2019 at 0:08
7

PHP bindParam() binds a PHP variable to a corresponding named or question mark placeholder in the SQL statement that was used to prepare the statement.

The correct way to use bindParam is:

$id = 1;
$sth = $DBH->prepare("SELECT * FROM juegos WHERE id = :id");
$sth->bindParam(':id', $id, PDO::PARAM_INT);// use bindParam to bind the variable
                          // ^ PDO::PARAM_INT - the value of the variable $id should be an int
                     // ^ $id - the variable being represented by ':id',
              // ^ :id - represents the variable
              // $id - the variable being represented by ':id',

PHP bindValue() binds a value to a corresponding named or question mark placeholder in the SQL statement that was used to prepare the statement.

$id=10;
$name=roadkill;
$sth = $dbh->prepare('SELECT *
    FROM juegos
    WHERE id < :id AND name = :name');
$sth->bindValue(':id', $id, PDO::PARAM_INT);// use bindValue to bind the variable's value
$sth->bindValue(':name', $name, PDO::PARAM_STR);// use bindValue to bind the variable's value

The key difference between these two methods is that unlike PDOStatement::bindValue(), with bindParam() the variable is bound as a reference and will only be evaluated at the time that PDOStatement::execute() is called.

2

The value for the :tabla parameter will be automatically quoted and escaped by PDO. The query executed would become:

SELECT * FROM 'juegos'

which is not valid SQL.

7
  • Then why this doesn't work either? $STH = $DBH->prepare("SELECT nombre FROM juegos WHERE id = :id"); $STH->bindParam(':id', 1, PDO::PARAM_INT); $STH->execute();
    – arielnmz
    Nov 11, 2013 at 8:53
  • 1
    @arielnmz because you don't have error reporting on, as you are supposed to Nov 11, 2013 at 8:54
  • What does error reporting has to do with the binding of named parameters in prepared statements?
    – arielnmz
    Nov 11, 2013 at 8:58
  • 1
    @arielnmz it does error reporting which will report an error to you. Nov 11, 2013 at 9:04
  • Ok, so you say that error reporting needs to be "turned on" to make bindParam() work? The question is rather simple and what you say is not useful at all, but thanks for answering anyway
    – arielnmz
    Nov 11, 2013 at 9:37
1

do not pass the value directly to BindParam.

try {
       // $DBH = new PDO("everything is", "ok", "here");
        $DBH = new PDO("mysql:host=localhost;dbname=test", 'root', '');
        $DBH->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
        $STH = $DBH->prepare("SELECT * FROM statstracker WHERE SrNo = :id");
        $id = 1; // here you should keep it as variable and pass it to param
        $STH->bindParam(':id', $id, PDO::PARAM_STR);
        $STH->execute();

        $STH->setFetchMode(PDO::FETCH_ASSOC);

        while($row = $STH->fetch()) {
            echo $row['SrNo']."<br/>";
        }

        $DBH = null;

        echo "Todo salió bien";

    } catch (PDOException $e) {
        echo "Error";
    }
3
  • This question already has an answer. No need to add any more. Jun 10, 2014 at 5:14
  • Oh, but this person has not marked his question as an answered, i think -1 you give me was for noting, you can see it this question is not answered. offcorse on net there is many slimier question my answer was exact for this one.
    – SAR
    Jun 10, 2014 at 5:17
  • Sorry for the loooooooong delay (I was not used to the side back in '13). The correct answer was: 1. That I can't use prep'd statements to define table or column names and 2. If I use a reference as a parameter I must use bindParam, and bindValue if I'm using a direct constant of the result of an expression, e.g. $var."foo". But this is a workaround and it's useful too.
    – arielnmz
    Jun 11, 2014 at 3:39
0

For me replacing the double quote by single quote fixed the issue.

Previous:

$STH = $DBH->prepare("SELECT * FROM statstracker WHERE SrNo = :id");

Solution:

$STH = $DBH->prepare('SELECT * FROM statstracker WHERE SrNo = :id');

And it works, though not sure why.

Hope it helps!

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.