Questions tagged [prepared-statement]
A Prepared Statement (or parameterized statement) is a precompiled SQL statement that serves to improve performance and mitigate SQL injection attacks. Prepared statements are used in many popular Relational Database Management Systems.
5,973
questions
3
votes
1
answer
30
views
PHP MySQLi execute without bind_param
The PHP documentation for 'execute' includes the example #2 (https://www.php.net/manual/en/mysqli-stmt.execute.php#example-1489) that looks like this :
$stmt = $mysqli->prepare('INSERT INTO myCity (...
0
votes
0
answers
23
views
Result Set Issue: Invalid operation: result set is closed. ERRORCODE=-4470, SQLSTATE=null
I have the list of id's as follows '01/A', '02/B', '03/C', '04/D', '05/E'
MASTER TABLE
ID
STATUS
02/B
NA
03/C
A
05/E
A
MASTER table I have the status of the above id's from conB Database. If id's ...
0
votes
2
answers
38
views
java.sql.SQLSyntaxErrorException: Youhave an error in your SQL syntax; check the manual that corresponds to your MariaDB server version
I use MySQL, why MariaDB in the error message? I have tried replacing the parameters `? by known values and it worked. The problem is in the
"?" as a placeholder for parameters 1 and 2 in ...
0
votes
1
answer
38
views
CosmosDb Parameterized Query using GUID
Using nuget package Microsoft.Azure.Cosmos v3.29.0
I'm attempting to use a parameterized query against CosmosDB and can't figure out the syntax to make this case work.
The data in CosmosDblooks like
{
...
2
votes
1
answer
27
views
Why does Python's sqlite3 module not respect the order of positional parameters?
Recently I ran across the following peculiar behavior, that can be explained by the following code sample:
import sqlite3, platform
insert = (10, "today")
db = sqlite3.connect(":memory:...
1
vote
1
answer
42
views
Athena Prepared Statement Parameter Order
I'm attempting to use the Athena parameterized queries feature in conjunctions with CTEs.
If I run a simple Athena CTE select statement like this, I get back no results even though I should get a ...
6
votes
1
answer
202
views
+50
Poor Performance on Specific Queries after MySQL 8.0 Upgrade
EDIT: I am seeing the same behavior in Python as PHP. Seems to be something with MySQL.
We are trying to upgrade from MySQL 5.7 to 8.0. Our codebase uses PHP MySQLi for queries to our MySQL server. In ...
0
votes
0
answers
23
views
Using mssql PreparedStatement in Node.js returning odd data
I am working on using a PrepareStatement in Node to protect against SQL injections:
let conn = sql.connect(config[2], function (err) {
var ps = new sql.PreparedStatement(conn);
let placeholders = {...
0
votes
1
answer
19
views
Looking for a way to parameterize a PSQL interval [duplicate]
I have the following code snippet working as intended in PSQL:
SELECT *
FROM Puzzle
WHERE date > current_date - interval '1' year
AND date < current_date + interval '50' day
I am now ...
0
votes
0
answers
7
views
Getting a "Call to a member function bind_param() on bool error" [duplicate]
When I use the following code to do a $mysqli->prepare function I get a error saying it tried to call the bind param on a bool and I can't figure out why the prepare statement isn't working
$var = ...
0
votes
0
answers
27
views
using prepared statement with libpq
creating a prepared statements using libpq - PQprepare && PQexecPrepared functions
and sending different parameters to this query.
how can I define types in this const Oid* paramTypes (like ...
0
votes
1
answer
44
views
Why won't this mysqli prepared insert statement work with multiple values?
I am having issues using a prepared insert statement.
The script is supposed to read the contents of the .txt file and insert the data into the corresponding columns in my database. Here is the error ...
-3
votes
0
answers
50
views
Maintaining Array Count When Values Are Empty [duplicate]
Using a form submit and a foreach loop, I am creating an array of names and values. These names and values will be used in a prepared statement so maintaining the count is important and it works fine ...
-2
votes
0
answers
39
views
cannot find symbol, JDBC prepareStatement doesn't work [duplicate]
I am working with function:
private void jButton1ActionPerformed(java.awt.event.ActionEvent evt) {
try{
Class.forName("com....
0
votes
0
answers
58
views
JDBC connection vs Statement in terms of releasing the resource [duplicate]
I know that a connection can be a network connection (tcp) between Java application process and our Database application process,
so when we're finished with a connection it's needed to close the ...
0
votes
2
answers
33
views
Should you use prepared statments on LIMIT
One day I was googling to understand when a prepared statment should be used. As I searched online many claimed that you should use always prepared statments. Now the question I have is... does this ...
0
votes
0
answers
13
views
How to use mysql prepared statements for many fields [duplicate]
I am trying to use mysql prepared statements as below..
$sql = "SELECT time from table1";
$result = mysqli_query($conn,$sql );
while ($row = mysqli_fetch_row($result))
{
$query = "...
0
votes
0
answers
26
views
Junit throwing nullpointerexception array executeBatch
Trying to figure out why I'm receiving this nullpointer exception, appreciate any help!
(Connection and prepared statement already set up in inherited class)
Method trying to test:
public int ...
0
votes
1
answer
38
views
What is the correct method for check login result with MySQLi Procedural?
if($_SESSION['CODE']==$_POST['captcha']){
$sql = "SELECT * FROM admin_user WHERE username = ? AND password = ?";
$result = mysqli_prepare($con,$sql);
if($result) {
...
0
votes
0
answers
32
views
how to Insert utf-8 encoded csv into latin-1 database [duplicate]
I've spent a fair bit of time reviewing and I have probably missed something but here goes.
I get a csv from a vendor that is UTF-8 encoded. Just to be sure I open in in notepad and save as utf-8.
My ...
0
votes
0
answers
55
views
Read from table while prepared statement inserts in batch
I have a Java running process that inserts data into a SqlServer DB table every 3s, using a PreparedStatement executeBatch(). (Process A)
// Get connection here
con.setAutoCommit(false);
// Create ...
0
votes
0
answers
11
views
Unable to prepare sqli [duplicate]
I can't figure out what is wrong with this code.
if($link === false)
echo "I am not connected to DB<br>" ;
else
echo "I am connected to DB<br>" ;
if($stmt = $...
0
votes
0
answers
29
views
How to SQL inject parameterized queries [duplicate]
I read online that SQL injection is possible through parameterized queries but I didn't find anything about how to do it. Does someone know how it's possible to SQL inject parameterized queries?
For ...
0
votes
0
answers
68
views
Why I get this sql error - SQLSTATE[42S22]
Look at this update query:
$sql = "UPDATE user u SET u.role_id = ?
, u.name = ?
, u.address = ?
, u.city ...
-1
votes
1
answer
28
views
Update data netbeans
I have a problem when updating data with NetBeans. When I update without changing the id, the error message appears key duplicate '10' for 'primary'
SQL = "update sumber set nama_sumber=?, ...
0
votes
0
answers
30
views
PHP - Prepared SELECT statement not adding values to bound variables [duplicate]
For some reason when I use mysqli prepared statements to select values from a database, they don't seem to work. The attached code is supposed to scan a database for a username and a password, and in ...
0
votes
1
answer
23
views
MySQL, PHP Prepared Statements Matching a String [duplicate]
I use prepared statements rather frequently to insert data, but I'm trying to select data and having an issue I can't seem to wrap my head around.
This code does not work at all. No error, just no ...
0
votes
1
answer
49
views
Teradata JDBC double query timeout ErrorCode 1475 in inserting in audit table
sometimes this prepared statment gives double query timeout
String insertStatement = "INSERT INTO " + Constant.AUDIT_SCHEMA
+ "."+ Constant.AUDIT_TABLE +" ...
0
votes
0
answers
16
views
Alter PSQL update function so it can be able to receive array of multiple parameters
Due to performance issue in my application (written in C++ and using libpqxx library), I'm writing new mechanism to BULK (batch) update one of my PostgreSQL tables (interface).
Those are the table ...
0
votes
1
answer
82
views
Codeigniter 4 Named Prepared statements throws error Code 500: "The number of variables must match the number of parameters in the prepared statement"
I am using Codeigniter 4 and when using the "?" placeholder for the prepared statements, everything works perfectly fine. But I am preferring to use the named bindings as there are too many ...
0
votes
1
answer
60
views
How to check MediaPlayer is ready to call start() | Android Kotlin
I want to check if the prepare() is finished to call start(),Because I sometime when I press the start button it starts playing but I can't pause or stop the player.
Now: I need to wait for a while to ...
0
votes
0
answers
32
views
How to get a Mariadb prepared statement using LOAD DATA LOCAL INFILE working
I am not able to get LOAD DATA LOCAL INFILE working as a prepared statement. Error 1064 is thrown, but the syntax displays correctly as a select statement (as text). Local infile is enabled "...
1
vote
1
answer
37
views
How do I go through the result of a parameterized query?
I'm trying to go through the result of a paremeterized query in PHP.
I'm trying this way
//creating a prepared statement
$stmt = $mysqli->stmt_init();
$query = "SELECT pcode,...
0
votes
0
answers
13
views
Does impyla (python) support prepared statements?
I'm working on a rest api in Python and I should use impyla. This library support prepared statement to prevent sql injection? Does the cursor support parametrized query?
1
vote
0
answers
19
views
How Do I Check If Things Did Not Go Wrong On Any Line When Using mysqli AND INSERT? [duplicate]
Which one is correct out of the following three that work fine in my inexperienced tests and why that one over the other two ?
Each code is different on the IFs that has this line:
echo 'INSERTING ...
0
votes
2
answers
110
views
Uncaught ValueError: mysqli_stmt::execute(): Argument #1 ($params) must be a list array
I'm trying to insert prepared statemant multiple values in my database through these two queries, which are both malfunctioning, returning either
Uncaught Error: Call to undefined method mysqli_stmt:...
0
votes
0
answers
27
views
Is it possible to use addBatch() for preparedStatements in the following way?
I have the following code.
try {
PreparedStatement preSt = null;
try {
preSt = conn.prepareStatement("insert into table values (?)");
preSt.setBigDecimal(1, bdVal);
...
0
votes
0
answers
13
views
Mysqli fetch array from stored prepared statement resulted in an error [duplicate]
I am working on a user registration page. I want to check if the username or email exist before an account is created. I saved the stored query from the prepared statement into the variable "$...
2
votes
1
answer
37
views
Using A PDO Prepared Statement On A Search Form Query - PHP [duplicate]
I have some images that are outputted onto a page with PHP from a MySQL database. The while loop that outputs them includes a join because it gets data from two database tables (an imageposts table ...
1
vote
1
answer
28
views
Using MYSQLI_USE_RESULT with prepared statements
How can I use
$stmt = $db->query($sqlString, MYSQLI_USE_RESULT);
But with prepare function? I need it, because I am using bind params, but now I need to also use MYSQLI_USE_RESULT for big data.
I ...
0
votes
0
answers
24
views
mysql PreparedStatement update not working. Exception is not clear [duplicate]
Background:
Need to write PreparedStatement to update table in mysql.
Using PreparedStatement, I am able to do Select and Insert by passing parameters in different methods of same class. But somehow ...
1
vote
0
answers
57
views
String length limitation using dbBind of DBI in R
I want to use DBI::dbBind to run some parameterized queries to update a SQL Server database but the string values I wrote got truncated at 256 characters. In the code below, I am supposed to see a ...
0
votes
1
answer
60
views
Redundant "Reset stmt" before "Execute" when setting useServerPrepStmts and cachePrepStmts to true in MySQL Connector/J
I'm using MySQL Connector/J (version 8.0.28) as the driver on client side. Following is part of my code for test purpose:
PreparedStatement ps = null;
String url = "jdbc:mysql://10.86.49.16:3306/...
1
vote
1
answer
62
views
How many times does a Java ResultSet ask for data from database?
Can I see how many times a Java ResultSet is asking for data from the database?
I have a big table (1 million records) and I want to see how many blocks of data it's pulling from the database. My ...
0
votes
0
answers
81
views
How to loop execution SQLExecute() in c++ with odbc?
Try to use Prepared stmt to loop execut a procdure in SQLServer
Here is my code
bool fileReader::insert(SQLHSTMT hstmt){
SQLPrepare(hstmt, (SQLCHAR*)"addBlock ?", SQL_NTS);
byte* write = (...
1
vote
1
answer
112
views
PHP MySQL prepared statement: procedural Insert / update example [duplicate]
I struggle to understand prepared statements in PHP to allow users to edit a MySQL-database.
The user input is UTF-8, typical examples are the name in Arabic, Chinese, ... It also generates a problem ...
0
votes
1
answer
112
views
Is using quoted_name safe way for parametrizing table name and fields in python's SQL Alchemy?
I spent a lot of time looking for solution to parametrize table names and field names in SQL Alchemy plain textual SQL queries for SQL Server. I stumbled upon several stackoverflow questions and other ...
0
votes
1
answer
72
views
Preparing a SQL statement that contains paired single and double quotes in PHP
Here goes. I have a 200-line MySQL query that contains six different Excel formulas in one of the columns, like this:
SELECT '%%%=""Greg''s #""&INDIRECT(""G"&...
0
votes
1
answer
33
views
Retrive ids of ResultSet and return as java.sql.Array
I have the follow:
def getIds(name: String): java.sql.Array = {
val ids: Array[Integer] = Array()
val ps: PreparedStatement = connection.prepareStatement("SELECT id FROM table WHERE ...
0
votes
0
answers
10
views
my sql statement doesn't work in asp.net? [duplicate]
I am using asp.NET and I want to make a prepared statement.
<WebMethod>
Public Sub fillCriteria2(ByVal critere As String)
Dim conn As SqlConnection = New SqlConnection(...