2 same codes in PHP, one is wrong

Question

// Not working
$stmt = $connection->prepare( "INSERT INTO numbers (homePhone, mobilePhone, officePhone)".
    " VALUES ($phone_1,$phone_2,$phone_3)");
$stmt->execute();

// Works
$stmt = $connection->prepare( "INSERT INTO numbers (homePhone, mobilePhone, officePhone)".
    " VALUES (?,?,?)");
$stmt->execute([$phone_1, $phone_2, $phone_3]);

When the first one is executed, it prints the error:

Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 1 no such column: blablabla in C:\Users\zahha\IdeaProjects\icd0007\index.php:78 Stack trace: #0 C:\Users\zahha\IdeaProjects\icd0007\index.php(78): PDO->prepare('INSERT INTO peo...') #1 {main} thrown in C:\Users\zahha\IdeaProjects\icd0007\index.php on line 78

The second one works perfectly. What is the problem? Just wondering.

score 1 · Answer 1 · answered May 02 '18 at 20:39

1

You need quotes around the variables in the first one, to indicate that the values are string literals in SQL.

$stmt = $connection->prepare( "INSERT INTO numbers (homePhone, mobilePhone, officePhone)".
    " VALUES ('$phone_1','$phone_2','$phone_3')");

answered May 02 '18 at 20:39

Barmar

741,623
53
500
612

Not sure why the downvote here. – Mike May 02 '18 at 20:55

David Dutra · Accepted Answer · 2018-05-02T20:42:05.790

-1

To make the first one work, you should put the variables between '. For example:

$stmt = $connection->prepare( "INSERT INTO numbers (homePhone, mobilePhone, officePhone)".
    " VALUES ('$phone_1','$phone_2','$phone_3')");
$stmt->execute();

Or taking them out of the string, like:

$stmt = $connection->prepare( "INSERT INTO numbers (homePhone, mobilePhone, officePhone)".
    " VALUES ('".$phone_1."','".$phone_2."','".$phone_3."')");
$stmt->execute();

edited May 02 '18 at 20:42

answered May 02 '18 at 20:39

David Dutra

391
7
21

1

Taking them out of the string doesn't solve it, you still need quotes around them. – Barmar May 02 '18 at 20:40
True. I will edit my answer – David Dutra May 02 '18 at 20:41
@maksim make sure you understand the concept of SQL injection and why parametrization / binding is desirable. – ficuscr May 02 '18 at 20:42
It's not in the scope of the question, but seeing how easily you can mess things up by not parameterizing, you might as well just do it all the time. – Mike May 02 '18 at 20:54

2 same codes in PHP, one is wrong

2 Answers2