php pdo execute array quotations

Question

The below prepared statement doesn't insert into the database.

$sid =1;
$sid2 = $GET['sid2']; //empty
$position = 0;
$name = "John";

$new = $connectdb->prepare("INSERT INTO `table1` VALUES ('',:sid,:sid2,:position,:name)");
                $new->execute(array(':sid'=>$sid,':sid2'=>$sid2,':position'=>$position,':name'=>$name));

When i add quotations to execute array values, then the insert works.

$new->execute(array(':sid'=>"$sid",':sid2'=>"$sid2",':position'=>"$position",':name'=>"$name"));

What i want to know is by adding quotations does this affect PDO's sanitization?

xdazz · Accepted Answer · 2012-07-06 05:59:35Z

2

The only difference in your case is $sid2 and "$sid2".

If $sid2 is a string, then $sid2 is same with "$sid2", but when $sid2 is null, then thing changed. If $sid2 is null, then "$sid2" will be empty string "".

If your column for sid2 has NOT NULL constraint, then you will failed to insert a null value, but you could insert empty string.

answered Jul 6, 2012 at 5:59

xdazz

161k38 gold badges255 silver badges278 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

s.webbandit · Accepted Answer · 2012-07-06 05:43:36Z

0

Myabe you should try to:

$new->execute(
 array(
  ':sid'=>$connectdb->quote($sid),
  ':sid2'=>$connectdb->quote($sid2),
  ':position'=>$connectdb->quote($position),
  ':name'=>$connectdb->quote($name),
 )
);

answered Jul 6, 2012 at 5:43

s.webbandit

17.2k17 gold badges60 silver badges82 bronze badges

1 Comment

xdazz Over a year ago

For prepared statement, you should not do quote.

Collectives™ on Stack Overflow

php pdo execute array quotations

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related