How would I turn this into a prepared statement?

Question

I'm new to prepared statements so I apologise in advance if this is a basic question but how would I turn the following code into a prepared statement and execute it later on?

<?php

$myQuery = "SELECT * FROM test WHERE ID=" . $_GET['ID'];

//run query
$result = $con->query($myQuery);
if (!$result) die('Query error: ' . mysqli_error($con));
?>

You start with the manuals http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php --- http://php.net/pdo.prepared-statements we're not here to do the work for you. — Funk Forty Niner, Nov 30 '15 at 16:53
why did this question receive an upvote? *giving my head a shake here*. There is ZERO EFFORT done here. — Funk Forty Niner, Nov 30 '15 at 16:56
Shake your head all you like! I've never come across a prepared statement. I've seen similar questions on here and watched a few youtube tutorials but they all seem to be done in a different context to what I'm trying to do and as I'm quite new to php it'd just help to see how this one in particular would look as a prepared statement. It's not always easy to find direct answers to stuff like this & you could have just ignored it — 92smallwizards, Nov 30 '15 at 19:46
Instead of talking down to me maybe you could help me out: Would I include the prepared statement in every html page or would I save it as a separate document and "Include" it? — 92smallwizards, Nov 30 '15 at 20:00

score 0 · Accepted Answer · edited Nov 30 '15 at 16:57

0

Take a look to http://www.w3schools.com/php/php_mysql_prepared_statements.asp, http://php.net/manual/en/mysqli.quickstart.prepared-statements.php (mysqli lib), or http://php.net/manual/en/pdo.prepared-statements.php (PDO lib).

Ex:

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Prepare statement
$stmt = $conn->prepare("SELECT * FROM test WHERE ID=?");

// set parameters 
$stmt->bind_param("i", $_GET['ID']);

// execute
$stmt->execute();

// close resources
$stmt->close();
$conn->close();

edited Nov 30 '15 at 16:57

Rajdeep Paul

16,887
3
18
37

answered Nov 30 '15 at 16:49

lpg

4,897
1
16
16

Thanks for your help. Just to clarify; would I include this on every html page that I wanted to us it or would I save it as a separate document and "Include" it? – 92smallwizards Nov 30 '15 at 19:49

score 0 · Answer 2 · answered Nov 30 '15 at 16:53

0

To do the call you could use somethign like;

$sCompanyCode = 'fkjahj12321';
$con = new PDO("connection string");

$sql = "SELECT CompanyID From Companies WHERE CompanyCode = :CompanyCode";
$st = $con->query( $sql );
$st->bindValue(":CompanyCode", $sCompanyCode, PDO::PARAM_STR);
$st->execute();

To retrieve 1st or singular result;

if($row = $st->fetch()){ 
    return (int)$row[0]; 
}

For multiple results;

$aResults = array();
while ($row = $st->fetch()){
    $aResults[] = $row;
}

answered Nov 30 '15 at 16:53

atoms

2,993
2
22
43

Thanks for your help. Just to clarify; would I include this on every html page that I wanted to us it or would I save it as a separate document and "Include" it? – 92smallwizards Nov 30 '15 at 19:49
it depends what pattern you are programming to. Take a look at OOP. You could for instance store this in a class. Or, leave on the page. If you want it on every page either a class or including a seperate file is a good idea. – atoms Dec 01 '15 at 08:57

How would I turn this into a prepared statement?

2 Answers2