PDO::exec() expects parameter 1 to be string, object given

Question

This is the code that makes the error:

$sql = 'INSERT INTO pedidos (pagado, instalado) VALUES ("'.$_POST['email'].'", "'.$_POST['b'].'") WHERE email="'.$_POST['2'].'"';
$stm = $conn->prepare($sql);
$conn->exec($stm);

See also [How can I prevent SQL-injection in PHP?](http://stackoverflow.com/q/60174) (which is not just about security, but about getting things to work correctly). — mario, Jul 04 '15 at 22:21

Dave Chen · Accepted Answer · 2015-07-04T22:26:49.583

That's not the proper way to use prepare and execute. The reason this was created was so that you wouldn't need to put logic and data together and put yourself at risk of an SQL injection attack.

$sql = 'INSERT INTO pedidos (pagado, instalado) VALUES (:pagado, :instalado)';
$stm = $conn->prepare($sql);
$stm->bindParam(':pagado', $_POST['email']);
$stm->bindParam(':instalado', $_POST['b']);
$stm->execute();

It also doesn't make sense to put a WHERE in an INSERT query. You're inserting into your table, you're not getting data.

However, if you're updating data based on other data, then you should use an UPDATE query.

UPDATE pedidos SET pagado=?, instalado=? WHERE email=?

An example of this would be:

$sql = 'UPDATE pedidos SET pagado=:padago, instalado=:instalado WHERE email=:email';
$stm = $conn->prepare($sql);
$stm->bindParam(':pagado', $_POST['email']);
$stm->bindParam(':instalado', $_POST['b']);
$stm->bindParam(':email', $_POST['2']);
$stm->execute();

Are you updating columns? If so, you need a different query entirely. — Dave Chen, Jul 04 '15 at 22:23
You forgot writing this: WHERE email="'.$_POST['2'].'" Yes im, its the first query i make so i need help — Juan Perez, Jul 04 '15 at 22:24
@JuanPerez Looks like you're trying to update data instead, can you try the updated answer? — Dave Chen, Jul 04 '15 at 22:27

Shahzad Barkati · Answer 2 · 2015-07-04T22:38:03.173

0

UPDATE - 2:

$sql = 'INSERT INTO pedidos SET pagado = ?, instalado = ? WHERE email = ?';
$stm = $conn->prepare($sql);
$stm->bindParam(1,$_POST['email']);
$stm->bindParam(2,$_POST['b'] );
$stm->bindParam(3,$_POST['2'] );

$stm->execute(); // here your code generate error

Reason: You put $stm in execute() , which makes an error.

edited Jul 04 '15 at 22:38

answered Jul 04 '15 at 22:15

Shahzad Barkati

2,532
6
25
33

Now it gives this error: Call to undefined method PDO::execute() – Juan Perez Jul 04 '15 at 22:18
1

change `$conn->execute()` to `$stm->execute()` will resolve your issue – Last1Here Jul 04 '15 at 22:19
Last error, not about this, its a syntax error en $sql in the part of WHERE, could you tell me why? – Juan Perez Jul 04 '15 at 22:22

PDO::exec() expects parameter 1 to be string, object given

2 Answers2