ODBC and SQL Server 2008: Can't use prepared statements?

Question

OK, so I cannot get this to work (either):

$stmt = odbc_prepare($conn, "SELECT * FROM Users WHERE username=?");
odbc_execute($stmt, array($username));
$user = odbc_fetch_object($stmt);


$stmt = $pdo->prepare("SELECT * FROM Users WHERE username=?");
$stmt->execut(array($username));
$user = $stmt->fetchObject();

Both return the same errors:

Warning: odbc_execute(): SQL error: Failed to fetch error message, SQL state HY000 in SQLExecute in user.php on line 24

Anyone know if it's possible to solve this, or are prepared statements off the table? If so, how should guard against SQL injections?

I added a try/catch block - does that output any helpful information? — Benny Hill, Nov 19 '12 at 19:18

Benny Hill · Accepted Answer · 2012-11-16T18:01:28.340

1

I never use the fetchObject method but how about this:

$stmt = $pdo->prepare("SELECT * FROM Users WHERE username=?");
$stmt->bindValue(1, $username);
try{
    $stmt->execute();
    while ($row = $stmt->fetch()){
       // Do whatever.
    }
}catch(PDOException $e){
    echo($e->getMessage());
}

I also notice the single quotes around your question mark ('?'), they shouldn't be there.

In order to use the try/catch stuff you'll need to include this when you create your PDO connection:

$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

And you might want to add this as well:

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, FALSE); // Try to use the driver's native prepared statements.

edited Nov 16 '12 at 18:01

answered Nov 16 '12 at 16:18

Benny Hill

6,191
4
39
59

Holy cheeseburgers! What a reversion! I'm sorry that edit happened, but the fixed sql are the ones that elicit the errors. I'm sorry about the confusion! – Theodore R. Smith Nov 16 '12 at 16:37
So do you still get the same error if you use the prepare and bindValue method I outline above rather than using the fetchObject method? – Benny Hill Nov 16 '12 at 16:43
When I try bindvalue() i get absolutely nothing. No warnings/error and a NULL result. – Theodore R. Smith Nov 16 '12 at 17:52
I edited my answer to include a try/catch block - does this echo out any helpful information? – Benny Hill Nov 16 '12 at 18:02

ODBC and SQL Server 2008: Can't use prepared statements?

1 Answers1

Linked