Call a SQL Server stored proc with parameters in PHP

Question

Based on this :

how to execute sql server stored procedure on php?

Tried the following :

$odbc = odbc_connect($DB1_ODBC,$DB1_USER,$DB1_PWD);  // proven to be fully functionnal
$result = odbc_exec($odbc,"CALL importClient( @name = 'hello',@number = 457)"); 

It does not call the stored procedure, i can't see any error code.

I replaced "CALL by "EXEC but it's not working in either cases.

Otherwise, the stored procedure can be run by using the same credentials to connect to the database, and using this SQL statement :

EXECUTE [dbo].[importClient] @name = 'hello',@number = 457

I couldn't find anything helpful, neither think of another way, and I definitely need the parameters.

Answer 1

$stmt = odbc_prepare($odbc, "call dbo.importClient(?, ?)");
odbc_execute($stmt, ["hello", 457]);

Using a prepared statement will protect your code from SQL injection attacks. Use this when you replace your literal values with variables containing user input.

Answer 2

It finally worked with :

$result = odbc_exec($odbc,"EXECUTE importClient @name = 'hello', @number = 457");

But this isn't protected against SQL injections, so it might not be the best answer