PHP PDO Prepared statements are not working, with positional and named placeholders and in execute() or in $stmt->bindParam(1,"xyz")

Question

My Code:

$conn = new PDO("mysql:host=127.0.0.1;dbname=server_users", "passgen", "Simplepasswordonlyforlocalhostacess!");

if ($conn->connect_errno) {

    exit();

}

$mac = $_POST['mac'];
fwrite($log,"InfoBlock \n  Mac: \t\t$mac  \n  ");

if (isset($_POST['RegCl'])) {
    $Upass = gen_uuid();

    fwrite($log,"Pass: \t$Upass \n  Exceptions: \n");


    try{
        $sql_new_client = $conn->prepare("INSERT INTO clients (Pass,mac)  VALUES ('$Upass','?')"); 
        $sql_new_client->bindParam(1, $mac); 
        $sql_new_client->execute();  

        //Here is the error ( The three lines above ^^)

        fwrite($log,"alive \n");

        fwrite($log , $sql_new_client->errorInfo()[2]);
    }
    catch (PDOException  $ex){

        fwrite($log,$ex->getMessage());
    }
    echo "$Upass";

    fwrite($log,"\nEnd \n");



}

function gen_uuid()
{
    return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000, mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff));
}

I will get the mac and the uuid is generated successfully as well. I've got no errors. In the database then there is just inserted the placeholder and not the string in the variable. I have to use prepared statements to prevent sql injections.

Thanks for help

Yours Lars

*"I've got no errors."* - You didn't check for them http://php.net/manual/en/pdo.error-handling.php and you have one. Consult the duplicate. — Funk Forty Niner, Jul 26 '18 at 17:03
`VALUES ('$Upass','?')` Bind all your parameters, not just the ones that come directly from `$_POST`. — Alex Howansky, Jul 26 '18 at 17:04
I'm not suggesting that was the answer to your issue (hence why it's a comment and not an answer) -- it's just generally sound advice. — Alex Howansky, Jul 26 '18 at 17:11
Ok I ve solved it. Thanks to @FunkFortyNiner . I cant use " ' " if I want to declare placeholders ;D See the duplicate — Lars ReaktoringHD Klette, Jul 26 '18 at 17:22
You're welcome @LarsReaktoringHDKlette Always glad to know when something gets solved and rather quickly :-) Cheers — Funk Forty Niner, Jul 26 '18 at 17:25

PHP PDO Prepared statements are not working, with positional and named placeholders and in execute() or in $stmt->bindParam(1,"xyz")

0 Answers0