On 12/3/2012 2:30 PM, Ethan Rosenberg, PhD wrote:
Dear List -

I am trying to use prepared statements with the following code:

                 $allowed_fields = array
                     ('Cust_Num' => 'i',  'Fname' => 's', 'Lname' =>
's', 'Street' => 's','City'=> 's',   'State' => 's',   'Zip' => 'i',
                     'Phone' => 'i', 'Notes' => 's'
                     );

                 if(empty($allowed_fields))
                 {
                      echo "ouch";
                 }

                 // Configure the query and the acceptable params to put
into the WHERE clause
                 $sql12 = 'SELECT * FROM Customers WHERE 1';

                // Magically put everything together
                 $types = '';
                 $args = array();
                 foreach( $allowed_fields as $k => $type )
                 {
                  if( !array_key_exists( $k, $allowed_fields ) )
                         continue;
                     else
                     {
                         if( ($_POST[$k]) != '')
                         {
                             $args[] = &$_POST[$k]; // Note the addition
of the ampersand here
                             $types .= $type;
                             $sql12 .= " AND ($k = ?)";
                         }
                     }
                 }

                 $stmt = mysqli_stmt_init($cxn);
                 mysqli_stmt_prepare( $stmt, $sql12 );

The search fails.

This debug code:

                 echo "For debugging and demonstration #1<br />";
                 echo 'Query: ' . $sql12 . PHP_EOL;
                 echo 'Bind types: ' . $types . PHP_EOL;
                 echo "arguments<br />";
                 print_r($args);

gives the following results:


For debugging and demonstration #1
Query: SELECT * FROM Customers WHERE 1 AND (Fname = ?) AND (Lname = ?)
AND (Street = ?) AND (City = ?) AND (State = ?) AND (Zip = ?) AND (Phone
= ?)
Bind types: sssssii
arguments
Array
(
     [0] =>
     [1] =>
     [2] =>
     [3] =>
     [4] =>
     [5] =>
     [6] =>  845745745
)

If I search the database from the command line, these are the results -


mysql>  select * from Customers where Phone=845745745;
+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+

| Cust_Num | Fname   | Lname        | Street | City   | State | Zip   |
Phone     | Date       | Notes               | P1   | P2   | P3   |
+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+

|    10016 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY    |   127 |
845745745 | 2012-12-01 |   tvgfuyholkijuhy   | NULL | NULL | NULL |
|    10017 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY    | 10952 |
845745745 | 2012-12-01 |   tvgfuyholkijuhy   | NULL | NULL | NULL |
|    10018 | okuibtg | uymkibtvgfrc | p7tvgf | Monsey | NY    | 32767 |
845745745 | 2012-12-02 |   tvgfuyholkijuhy   | NULL | NULL | NULL |
+----------+---------+--------------+--------+--------+-------+-------+-----------+------------+---------------------+------+------+------+

3 rows in set (0.00 sec)

This is the output routine:

                 if(count($errors_array) == 0)
                 {
     ?>

                         <center><b>Search Results</b></center><br />
                             <center>
                         <table border="4" cellpadding="5"
cellspacing="55"  rules="all" frame="box" style="table-layout: fixed;">
                         <tr class="heading">
                         <th>Cust_Num</th>
                         <th>First Name</th>
                         <th>Last Name</th>
                         <th>Street</th>
                         <th>City</th>
                         <th>State</th>
                         <th>Zip</th>
                         <th>Phone</th>
                         <th>Notes</th>




     <?php             $i = 0;
                     do
                     {
                         {

                             $vara2 = array(array($Cust_Num, $Fname,
$Lname, $Street, $City, $State, $Zip, $Phone, $Notes));
                             $vara2[$i][0]    = $Cust_Num;
                             $vara2[$i][1]    = $Fname;
                             $vara2[$i][2]    = $Lname;
                             $vara2[$i][3]    = $Street;
                             $vara2[$i][4]    = $City;
                             $vara2[$i][5]    = $State;
                             $vara2[$i][6]    = $Zip;
                             $vara2[$i][7]    = $Phone;
                             $vara2[$i][8]    = Notes;

                             $_SESSION['exe'] = 2;
     ?>


                             <tr>
                             <td>  <?php echo $vara2[$i][0]?>  </td>
                             <td>  <?php echo $vara2[$i][1]?>  </td>
                             <td>  <?php echo $vara2[$i][2]?>  </td>
                             <td>  <?php echo $vara2[$i][3]?>  </td>
                             <td>  <?php echo $vara2[$i][4]?>  </td>
                             <td>  <?php echo $vara2[$i][5]?>  </td>
                             <td>  <?php echo $vara2[$i][6]?>  </td>
                              <td>  <?php echo $vara2[$i][7]?>  </td>
                             <td class="first-col"><?php echo
$vara2[$i][8] ?></td>
     <?php                     echo "</tr>\n";
                                 $i = $i + 1;
                             }
                     } while (mysqli_stmt_fetch($stmt)); //end do-while
                                 $imax = $i;
                                 echo "</table>";
                                 echo "</center>";
                                 echo "</form>";


Help and advice, please.

Ethan





What is your question?

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to