sql - PHP PDO statement with varying parameter counts -
i've started using php pdo prevent sql injection, i'm having problem statement though change depending on parameters i'm passing through url change pages results. part i'm struggling on how can add $_get['cat_id']
when url has cat_id execute array. here's working version prone sql injection, in advance help!
php
$and = ''; if (isset($_get['cat_id'])) { $and = "and art_cat_id = ".$_get['cat_id']; } $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc"); $statement_article->setfetchmode(pdo::fetch_assoc); $statement_article->execute(array(':art_sta_id' => "1"));
here's tried fails if there no cat_id
in url
php
$and = ''; if (isset($_get['cat_id'])) { $and = "and art_cat_id = :cat_id"; } $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc"); $statement_article->setfetchmode(pdo::fetch_assoc); $statement_article->execute(array(':art_sta_id' => "1",':cat_id' => $_get['cat_id']));
adjust parameter array when there's cat_id:
$and = ''; $params = array(':art_sta_id' => "1"); if (isset($_get['cat_id'])) { $and = "and art_cat_id = :cat_id" $params[':cat_id'] = $_get['cat_id']; } $statement_article = $db->prepare("select * app_articles art_sta_id = :art_sta_id $and order art_date desc"); $statement_article->setfetchmode(pdo::fetch_assoc); $statement_article->execute($params);
Comments
Post a Comment