read the input name as a row in the database table

Question

when i try to add a new studio in my php application in this example i use newstudio as a name i get this error i think that it read the name i give as a row in the database table Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S22]: Column not found: 1054 Champ 'newstudio' inconnu dans field list'

private $conn;

public function __construct()
{
    $database = new Database();
    $db = $database->dbConnection();
    $this->conn = $db;
}
public function addStudio($sname,$sdes,$sidusr)
{
    $stmt = $this->conn->prepare("INSERT INTO studio (name,des,idusr) VALUES ($sname,$sdes, $sidusr)");
    $stmt->execute();
}

ScaisEdge · Answer 1 · 2017-03-12T19:52:37.357

1

if you have string value you should use single quote around these vars

public function addStudio($sname,$sdes,$sidusr)
{
    $stmt = $this->conn->prepare("INSERT INTO studio (name,des,idusr)
          VALUES ('$sname','$sdes', '$sidusr')");
$stmt->execute();
}

or you could use a parametrized query

public function addStudio($sname,$sdes,$sidusr)
{
    $stmt = $this->conn->prepare("INSERT INTO studio (name,des,idusr)
          VALUES (:sname,:sdes, ':sidusr)");
    $stmt->bindParam(':sname', $sname);
    $stmt->bindParam(':sdes', $sdes);
    $stmt->bindParam(':sidusr', $sidusr);

    $stmt->execute();
}

edited Mar 12 '17 at 19:52

answered Mar 12 '17 at 19:47

ScaisEdge

131,976
10
91
107

Why not make use of `prepare()`, instead of adding quotes yourself? – Xorifelse Mar 12 '17 at 19:48
The answer is strictly related to the question .. but your comment is lead a good suggestion .. the OP could use a PDO parametrized query .. answer updated – ScaisEdge Mar 12 '17 at 19:52

score 0 · Answer 2 · answered Mar 12 '17 at 19:55

Values require a ' wrapped around it, but don't add it yourself. You are already using prepare(), make use of it.

public function addStudio($sname,$sdes,$sidusr){
  $stmt = $this->conn->prepare("INSERT INTO studio (name,des,idusr) VALUES (?,?,?)");
  $stmt->execute([$sname, $sdes, $sidusr]);
}

Also, you should actually check the value of $stmt and verify if execute() did its job correctly.

read the input name as a row in the database table

2 Answers2