sql - PHP PDO statement with varying parameter counts -


i've started using php pdo prevent sql injection, i'm having problem statement though change depending on parameters i'm passing through url change pages results. part i'm struggling on how can add $_get['cat_id'] when url has cat_id execute array. here's working version prone sql injection, in advance help!

php

$and = ''; if (isset($_get['cat_id'])) {     $and = "and art_cat_id = ".$_get['cat_id']; }     $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc");  $statement_article->setfetchmode(pdo::fetch_assoc);   $statement_article->execute(array(':art_sta_id' => "1")); 

here's tried fails if there no cat_id in url

php

$and = ''; if (isset($_get['cat_id'])) {     $and = "and art_cat_id = :cat_id"; }   $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc");  $statement_article->setfetchmode(pdo::fetch_assoc);   $statement_article->execute(array(':art_sta_id' => "1",':cat_id' => $_get['cat_id'])); 

adjust parameter array when there's cat_id:

$and = ''; $params = array(':art_sta_id' => "1");  if (isset($_get['cat_id']))  {   $and = "and art_cat_id = :cat_id"   $params[':cat_id'] = $_get['cat_id']; }     $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc");  $statement_article->setfetchmode(pdo::fetch_assoc);   $statement_article->execute($params); 

Comments

Popular posts from this blog

linux - xterm copying to CLIPBOARD using copy-selection causes automatic updating of CLIPBOARD upon mouse selection -

c++ - qgraphicsview horizontal scrolling always has a vertical delta -