MySQL PDO Tutorial Lesson 6 - Prepared statements with placeholders

preview_player
Показать описание

How to use placeholder question marks in prepared statements to return records from a MySQL database to which we have connected using PDO.
Рекомендации по теме
Комментарии
Автор

This series of videos helped me get something working that I have been working on for weeks now.

StormVeilGaming
Автор

I was waiting for an error to happen. You did come far without any errors though :)

coldmow
Автор

Are you a professor omg I've learnt so much from you.

chimpionboy
Автор

Hello Rickard i find this verry useful thank u.

zaven
Автор

Richard, for some reason the wildcard is not working for me, could you advise please. My code is below. My dbase columns are first last and postcode

$stmt = $db->prepare("SELECT * FROM names WHERE LIKE ?");
$stmt->bindValue(1, '%d%');
$stmt->execute();

while($row =

$first = htmlentities($row['first']);
$last = htmlentities($row['last']);
$pcode =


echo $first . ' ' . $last . ' ' . $pcode . $space;

}

Thanks

DavidAshby
Автор

Richard, could you tell me if this statement should work as I am not sure whether it is the statement or the fact I am using it in the wrong place within the code as I am using password_verify()

if($pdo){
$stmt = $pdo->prepare("select * from users where username = :username && password = :password");
$stmt->bindParam(":username", $username);
$stmt->bindParam(":password", $unhashed);
echo '<pre>';
if($stmt->execute()){
$rows =
print_r($rows);
}

}
echo '</pre>';


If I run the statement with just username = :username I get an array returned but the password is causing an issue.

Thanks

DavidAshby
Автор

Should you bind every field that you are retrieving or can you just bind the id as the PK or does that open your query to mysql injection?

DavidAshby
join shbcf.ru