views:

44

answers:

1

Hello everyone.

I currently have to implement a query on a postgres database using a prepared statement. My current code looks like this:

 $arrFilter = array("", "");
 $result = $db->prepare("select_music", "SELECT * FROM tblmusik WHERE lm_titel LIKE '%" . "$1" . "%' AND lm_text LIKE '%" . "$2" . "%');

( db->prepare() just executes pg_prepare() )

I then execute this query:

 if (isset($data['lm_titel'])) {
   $arrFilter[0] = $data['lm_titel'];
 } 
 if (isset($data['lm_text'])) {
   $arrFilter[1] = $data['lm_text'];
 }
 $result = $db->execute("select_music", $arrFilter);

But i get the following error:

Warning: pg_prepare(): Query failed: ERROR: could not determine data type of parameter $1 in /home/freevma/htdocs/freeVMA/global/cls/db.php on line 110

I would be happy to get this running, and appreciate your help!

brot

+3  A: 

Try $arrFilter[0] = '%' . $data['lm_titel'] . '%';

Databases don't allow for parameters to be merged like that (unless you use the DB's concatenation operator). '%'||$1||'%' should be legal too.

Kenaniah
+1 for the second option (and the remark that when putting `$1` etc. in double quotes, the `$` should be escaped (so, either use `'$1'` or `"\$1"`.
Wrikken
Thanks, that would explain it Kenaniah. I cant try it at the moment, but i will just set that as the accepted answer and report back as soon as i tried it :)
brot