views:

135

answers:

1

Currently, I'm peppering form submissions to account for single quotes & other garbage.

 $form_field_value= str_replace("'", "''", stripslashes($form_field_value));

It is to prep the value for insertion using:

 $insert_sql = "insert into table (field) values ('".$form_field_value."')";
 odbc_exec($conn, $insert_sql);


Essentially, I want to use placeholders for these insert/update statements.

I tried defining $par1 and $par2 as literals and then executing this

$insert_sql = "insert into table (field,txt) values (?,?)";
odbc_exec($conn, $insert_sql, $par1, $par2);

It failed and gave me this error:

Warning: odbc_exec() [function.odbc-exec]: SQL error: [Microsoft][ODBC SQL Server Driver]COUNT field incorrect or syntax error, SQL state 07001 in SQLExecDirect in test.php on line 10

Line 10 is the exec statement.


I can't find syntax for using placeholders with this odbc driver. Any suggestions?

The $conn connection variable is working fine.


EDIT:

Last attempt still failing - odbc_execute() is an undefined function. I have to use odbc_exec()

$par1="eggs";
$par2="milk";

$insert_crs = "insert into table (field,txt) values (?,?)";
$stmt = odbc_prepare($conn, $insert_sql); 

odbc_exec($stmt, array($par1, $par2));
+1  A: 

According to http://www.php.net/manual/en/function.odbc-prepare.php , you should be preparing then executing your SQL statement, and you should be providing a new array for the third argument to dobc_execute():

<?php
$a = 1;
$b = 2;
$c = 3;
$stmt    = odbc_prepare($conn, 'CALL myproc(?,?,?)');
$success = odbc_execute($stmt, array($a, $b, $c));
?>

That means your code should look like:

$insert_sql = "insert into table (field,txt) values (?,?)";
// the following line is new, compared to your code
$stmt = odbc_prepare($conn, $insert_sql); 
// note that the following line wraps $par1 and $par2 with array()
// struck out version was incorrect - copy/paste error :(
odbc_exec($stmt, $insert_sql, array($par1, $par2));
odbc_execute($stmt, array($par1, $par2));
atk
thanks... yeah i was browsing that site and ended the browse upon seeing odbc_execute rather than exec.... trying it now
CheeseConQueso
no good... I tried exec and execute... i thought this would be the case
CheeseConQueso
Could you post your changed code? And are you still getting the exact same error? And, in case you copy/pasted my code, I made an error, myself - correcting momentarially...
atk
see revision of question
CheeseConQueso
Ah - understood. Makes me wonder if there's a missing library, or if the docs I was looking at are for a different version of PHP than you're using... unfortunately, I'm pretty new to PHP, so I'm not sure the right questions to ask... Hopefully someone else will come along with better information.
atk