prepared-statement

When we use PreparedStatement instead of statement?

Hi, I know the advantages of useing prepareStatement which are _When you execute a query this query is rewritten and compiled and the by the database server _Protected against SQL injection but I want to know that when we use it instead of Statement? thanks. ...

PHP PDO Prepared statement query not updating record

I am having a problem using PHP's PDO object to prepare an update statement and updating the record. I have taken the raw SQL query and ran it in phpMyAdmin with the params replaced by their values that are passed to the function. Which updates the record as intended. However, when ran from the script it does not update. It throws zero e...

PHP PDO: how does re-preparing a statement affect performance

I'm writing a semi-simple database wrapper class and want to have a fetching method which would operate automagically: it should prepare each different statement only the first time around and just bind and execute the query on successive calls. I guess the main question is: How does re-preparing the same MySql statement work, will PDO ...

using prepared mysqli statements to bind parameters into the SELECT section of a query

I am building a web app that imports data from data feeds in php/mysql. I import the data into a buffer/temp holding table. As each data format is different I choose the column to select based on the particular source. I am having trouble getting this query to work in this context : $stmt = $this->dbObj->prepare("SELECT mk.PK_phone_mak...

Prepared statement with PHP and MySQL without using mysqli

Hi, I'd like to know if it is possible to create a prepared statement with PHP and MySQL using the mysql library rather than the mysqli library. I can't find anything on the PHP documentation. Thanks. ...

Is using a database-level MD5 function a bigger security risk than an application level function?

I've got a chunk of code that validates a user's username and password, which goes something like this: $sql = "SELECT * FROM user WHERE username='{$_POST['username']}' AND password=MD5('{SALT}{$_POST['password']}')"; Is this any more/less secure than doing it like this? $sql = "SELECT * FROM user WHERE username='{...

¿How to bind params to an statement using a loop?

Hi! I'm just learning to use PDO, and I want to bind params to a delete statement using a loop. I'm using a code like this that definitely doesn't works: public function delete_user ($post, $table='mytable') { $delete = $this->conn->prepare("DELETE FROM $table WHERE id IN (:id) "); ...

Database connection for prepared statements

Using an ODBC connection to a mysql database, the connection times-out after a period of 8 hours (the default). In order for my application to be resilient, it must recreate this connection to issue a prepared statement query. Is it possible to issue a new database connection for a prepared statement? Does it make sense to do so? It ...

Safely using prepared statements to query database

I'm trying to write a function that is versatile in the queries it is allowed to make, but also safe from injection. The code below throws an error as is, but if I run it with 'name' instead of ':field' it works fine. $field = "name"; $value = "joe"; function selectquery($field, $value) { global $dbcon; $select = $dbcon->prepare...

PHP prepared statement: Why is this throwing a fatal error?

Have no idea whats going wrong here. Keeps throwing... Fatal error: Call to a member function prepare() on a non-object ...every time it gets to the $select = $dbcon->prepare('SELECT * FROM tester1');part. Can somebody shed some light as to what I'm doing wrong? function selectall() //returns array $client[][]. first br...

When is quoting necessary in prepared statements of pdo in PHP?

It's from the comment under this answer,but I really don't figure out what he means: http://stackoverflow.com/questions/2211919/how-to-change-from-mysql-to-pdo-using-prepared-statements-in-php/2211992#2211992 ...

Should I use prepared statements for MySQL in PHP PERFORMANCE-WISE?

I understand the security benefits of prepared statements in MySQL. No need to cover that topic here. I'm wondering about the performance aspect of them. Now, I know when a query using a prepared statement is executed twice in a single PHP script, it's faster because the query is only parsed once, once for each query. The client makes o...

How to enable implicitCachingEnabled (statement caching) from Tomcat for oracle?

Hi, I've been reading about implicitCachingEnabled and MaxStatements with the oracle jdbc driver. I've tried adding implicitCachingEnabled="true" into the server.xml for the datasource definition but it makes no difference. I've also noted other posts admittedly from a long time ago, where people have failed to get this setting to wor...

mysqli, loops, and prepared statements

Ok, I don't use php often enough to remember it when I wander back into it. I'm going a bit crazy with this one. I'll post the code below but a few quick explanations. con.php is a php file that creates the database connection $wkHook. There is no issue at all with the connection, so that is not my problem. Basically, I am selecting...

MySQL multiple prepared statements with same connection

What exactly are the rules for setting up multiple prepared statements simultaneously (with a single DB connection)? I often have loops that include multiple queries; it would be nice to set up 3 prepared statements, cycle through them, then close them all. What I've found is that sometimes they work together, sometimes they don't. For ...

Problems with string parameter insertion into prepared statement

Hi, I have a database running on an MS SQL Server. My application communicates via JDBC and ODBC with it. Now I try to use prepared statements. When I insert a numeric (Long) parameter everything works fine. When I insert a string parameter it does not work. There is no error message, but an empty result set. WHERE column LIKE ('%' ...

A Java preparedStatement with a setBigDecimal parameter raises ORA-03115

The problem is: I'm setting a preparedStatement for a query in a table with this fields (among others): TABLE1_RSPN NUMBER(8,0) TABLE1_AFDV NUMBER(8,0) TABLE1_VALUE NUMBER(17,2) TABLE1_NOTE VARCHAR2(255 BYTE) TABLE1_USR VARCHAR2(20 BYTE) ... Trying to get some info into my Java app, I set a preparedStatement which raises the Orac...

Using timestamp type with pg_prepare

Running the following code: $preCallMatch = pg_prepare($dbcp, 'callMatch', "SELECT duration FROM voip_calls WHERE system_id = $1 AND call_start => $2 ...

Best practice for where = ?, where in (?) clauses in Prepared Statements?

Is it more performant to use a Prepared Statement with one question mark in it fifty times, or to use a Prepared Statement with fifty question marks in it once? Essentially is Where Person = ? or Where Person IN (?, ?, ?, ...) better? Example Say you have a table with a column, country, and then a few relational tables away you have t...

Which should I close first, the PreparedStatement or the Connection?

When using a PreparedStatement in JDBC, should I close the PreparedStatement first or the Connection first? I just saw a code sample in which the Connection is closed first, but it seems to me more logical to close the PreparedStatement first. Is there a standard, accepted way to do this? Does it matter? Does closing the Connection also...