tags:

views:

102

answers:

2
$dml = "insert into bookmark(accountId,category,url,hash,title,created) value($_SESSION[accountId],$_POST[category],'$_POST[url]',md5('$_POST[url]'),'$_POST[title]',now())";

mysql_query($dml,$con);

How do I do this statement using prepared statements in PDO?

+2  A: 
$dml = $db->prepare("INSERT INTO bookmark (accountId, category, url, hash, title, created) VALUES (:account_id, :category, :url, MD5(:url), :title, NOW());");

$dml->bindParam(':account_id', $_SESSION['accountId']);
$dml->bindParam(':category', $_POST['category']);
$dml->bindParam(':url', $_POST['url']);
$dml->bindParam(':title', $_POST['title']);

$dml->execute();
Brock Batsell
+2  A: 
$dml = "INSERT INTO bookmark (accountId, category, url, hash, title, created) "
    . "VALUES (:accountId, :category, :url, MD5(:url), :title, NOW())";
$statement = $pdo->prepare($dml);
$parameters = array(
    ":accountId" => $_SESSION["accountId"],
    ":category" => $_POST["category"],
    ":url" => $_POST["url"],
    ":title" => $_POST["title"]);
$statement->execute($parameters);
Adrian
It will automatically quote the string,right?
PDO will handle escape and quoting as needed.
acrosman
@user198729: quoting is only necessary if the underlying driver has to simulate prepared statements. Generally speaking, values are sent separate from the statement, so there's no confusion between where a value ends and the rest of the statement begins.
outis
Can you be more specific about when is quoting necessary?
outis