PDO exec silently fails query seems legit

Asked Jan 04 '20 at 05:32

Active Jan 04 '20 at 08:22

Viewed 24 times

$columns = "'".implode("','", array_keys($result_1[0]))."'";
  $values = "`".implode("`,`", array_values($result_1[0]))."`";

  $stmt_2 = $db->prepare("INSERT INTO orders ($columns) VALUES ($values)"); try{
    foreach($result_1 as $a){
      $stmt_2->execute(($a));
    }
    var_dump($stmt_2);
  }catch(Exception $e){
    var_dump($e);
  }

The query output is:

INSERT INTO orders ('product_id','quantity','user_id','created','modified',
        'address','phone','email') 
    VALUES (`1`,`1`,`f0df07b5434d46ab9df6295c1c265913106a6f33`,`2020-01-04 06:08:43`,`2020-01-04 10:53:43`,
        `LA`,`9898989898`,`rabc@mail.com)

edited Jan 04 '20 at 08:22

Nigel Ren

56,122
11
43
55

asked Jan 04 '20 at 05:32

MattJohnson

use ` in `$columns` and ' in `$values` – Devsi Odedra Jan 04 '20 at 05:36
Your code is open to SQL injection attacks. Use bound parameters to avoid this, and it'll probably solve your other issues too. – Greg Schmidt Jan 04 '20 at 05:55
I am new to PDO... by bound parameters do you mean db->bind.... ? – MattJohnson Jan 04 '20 at 05:57
@DevsiOdedra Thanks but the additional data $addr from $_POST['address'] cannot be concatenated and changed to string with single quote... $columns .= ",'address','phone','email'"; $values .= ",`$addr`,`$phn`,`$email`"; – MattJohnson Jan 04 '20 at 05:58

PDO exec silently fails query seems legit

0 Answers0