Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 293831

SQL parameters bound with PDOStatement::bindParam() ignored.

$
0
0

Src. file: /includes/database/database.inc:2121
Drupal class: DatabaseStatementBase
The issue code line:
public function execute($args = array(), $options = array()) {...
The proposed improved line:
public function execute($args = NULL, $options = array()) {...

Problem description:
Use case:

<?php
//...
$sql = 'SELECT * FROM  foo WHERE bar=:bar';
$stmt = $dbh->prepare($sql);
$stmt->bindParam(':bar', $bar);
$stmt->execute();
//...
?>

Html output:

ERROR:
PDOException: SQLSTATE[HY093]: Invalid parameter number: no parameters were bound in ...

The cause and the solution:
$stmt->execute(); // see the Use case above
calls DatabaseStatementBase:execute($args = array(), ...) [which overrides PDOStatement::execute([ array $input_parameters ])]

<?php
//...
 
$return = parent::execute($args); // (database.inc:2139)
//...
?>

Thus in the case of $stmt->execute(); // i.e. calling execute with NO supplied params
an empty array (i.e. $args = array()) will be passed to PDOStatement::execute().
But if PDOStatement::execute() receives anything exept NULL it will consider this argument as the SQL parameters to bound and completely ignore all the parameters previously bound by means of bindParam() method.

The solution (see the proposed line above) is to use $args = NULL as the default argument in the signature of DatabaseStatementBase::execute().

Works just fine!

Best regards,
snegh

Viewing all articles
Browse latest Browse all 293831

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>