prepared-statement

php mysqli WHERE IN (?,?,? ...)

According to http://us2.php.net/manual/en/mysqli-stmt.bind-param.php, the different types are: i corresponding variable has type integer d corresponding variable has type double s corresponding variable has type string b corresponding variable is a blob and will be sent in packets However, how can you handle this: ->prepare(...

How to determine optimum prepared statement cache size when using Hibernate

AFAIK, Hibernate transforms all sql to prepared statement form before issuing it to the database. When tuning the application, the size of prepared statement cache can be an important factor. How to determine the optimum value when using Hibernate, given that it creates prepared statements “under the hood”. ...

Java/Oracle: executing a prepared statement fails on a second iteration of a loop (not all variables bound). Why?

I'm debugging a Java App, which connects to Oracle DB via a thin client. The code looks as follows: (i'm trying to simplify the use case here so pardon me if t does not actually comile) Connection conn = myEnv.getDbConnection(); CallableStatement call = conn.prepareCall( "{ ? = call SomePackage.SomeFunction (?)}"); call.regist...

In what situations is the prepare method of a SqlCommand object useful?

Does any body know that in what situations the prepare method of an ADO.NET SqlCommand Object is useful? ...

grab current user id - php class

Hello everone, I am buidling a small job application website, and i'm using a the basis of a login system taken from a Nettuts.com tutorial. The logging in works fine, but I am having trouble getting the details for the currently logged in user, for example if a user enters their personal details, i can process the data into the databas...

Are PHP MySQLi prepared queries with bound parameters secure?

Historically, I've always used mysql_real_escape_string() for all input derived from users that ends up touching the database. Now that I've completely converted over to MySQLi and I'm using prepared queries with bound parameters, have I effectively eliminated the possibility of SQL injection attacks? Am I correct in saying I no lon...

Is there a way to do a prepared statement in linq2sql using a stored proc?

Based on what I can see the answer is no, but there is always a possibility ...

Prepared statements and the IN expression

I have a database where users can search for records that have on or more of a list of items. I'm using IN to do the search, but I can't get IN to work with prepared statements. This is what I've tried: SELECT * FROM tbl1 WHERE col IN (?) But the prepared statement treats the list of items I pass it as a single item. How can I make th...

How does a PreparedStatement avoid or prevent SQL injection?

I know that PreparedStatements avoid/prevent SQL Injection. How does it do that? Will the final form query that is constructed using PreparedStatements will be a string or otherwise? ...

Java deque / prepared statement memory leak.

One of the following pieces of code generates a memory leak, any idea which part? 1) private Deque<Snapshot> snapshots = new LinkedList<Snapshot>(); Iterator<Snapshot> i = world.getSnapshots().descendingIterator(); while (i.hasNext()) { Snapshot s = i.next(); if (curTime - s.getTimestamp() > 60000) { i.remove(); ...

Why does SQLite complain about the syntax of my prepared statement?

I'm having trouble getting a prepared statement in sqlite3 to work. I'm working with Perl and the Perl DBD framework. Below is the code I use: #This is a function I have defined sub query($@){ my $st = $db->prepare(shift); $st->execute(@_); } #And it is used like so query("UPDATE rooms SET name = ?, SET capacity = ? WHERE id = ...

mysqli - $stmt->num_rows returning 0

Hello everyone, i am looking to count the number of records returned by the query below using mysqli / prepared statements: $mysql = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or die('There was a problem connecting to the database'); $stmt = $mysql->prepare('SELECT id,vcref,jobtitle,jobtype,jobintro,closingdate FROM jobs WHERE...

JDBC, MySQL: getting bits into a BIT(M!=1) column

I'm new to using JDBC + MySQL. I have several 1/0 values which I want to stick into a database with a PreparedStatement. The destination column is a BIT(M!=1). I'm unclear on which of the setXXX methods to use. I can find the references for what data comes out as easily enough, but how it goes in is eluding me. The values effectivel...

JDBC, MySQL: getting back row data from PreparedStatement executes.

I'm using the following setup: public MySQLProcessWriter(Connection con) throws SQLException { String returnNames[] = {"processId","length","vertices"}; addresser = con.prepareStatement("INSERT INTO addressbook (length, vertices, activity) VALUES (?, ?, ?)", returnNames); } processId corresponds to an auto-incrementing column in th...

Which tokens can be parameterized in PDO prepared statements?

I'm playing around with prepared statements in PHP/PDO. The basic queries work fine, passing a value to the WHERE clause: $stmt = $db->prepare( 'SELECT title FROM episode WHERE id=:id' ); $stmt->bindParam( ':id', $id, PDO::PARAM_INT ); $id = 5; $stmt->execute(); However I have a situation where I need to pass variables for the field n...

Can't Insert Data Into Tables Containing Auto Increment Primary Key Using PHP Prepared Statements

I know I have that my connection to the database works, and a test I did using no auto-increment id worked fine for me. The code below refuses to work and I can't find a a way around it. My table has 3 columns, ID (auto increment), name and value. What do I need to change in order to get this to work? Thanks in advance //create placeh...

Mysqli Prepared Statement Problem in bindParam()

Hi guys. Just as usual i was looking around best practices with PHP, and prepared statements seems the kind of stuff i should now how do with my eyes closed. So i started playing around with some examples i've found. I've got this error when running the script: Fatal error: Call to a member function bindParam() on a non-object in...

How can I print the SQL query executed after Perl's DBI fills in the placeholders?

I'm using Perl's DBI module. I prepare a statement using placeholders, then execute the query. Is it possible to print out the final query that was executed without manually escaping the parameters and dropping them into the placeholders? Thanks ...

MySQL/C++ and Prepared Statements: setInt always 0

I'm using the MySQL Connector/C++ library to insert values into a database table. I'm following the examples at http://dev.mysql.com/tech-resources/articles/mysql-connector-cpp.html almost exactly. However, I can't seem to get prepared statements to work with value placeholders. sql::mysql::MySQL_Driver* driver = sql::mysql::MySQL...

Returning specific rows using prepared statements

I have a problem where my prepared statement appears to only be returning the number of rows returned rather than the value of the row. Below is my code. I did try google for this but it doesn't tell me anything! If someone could tell me what I am doing wrong and how to fix it I would be very appreciative. Thanks $query2 = 'SELECT * FRO...