mysql - PHP PDO is ruining my $_POST values? -
edit: edit of original code: (i changed if "if($_post['break'] != "")" test , doesnt work, neither of other varients i've tried.
if($_server['request_method'] != 'post') { echo '<form method="post" action=""> category name: <input type="text" name="cat_name" /> category description: <textarea name="cat_description" /></textarea> <input type="checkbox" value="break">is table break?<br> <input type="submit" value="add category" /> </form>'; } $sql= 'insert categories(cat_name, cat_description, isheader) values (:cat_name, :cat_description, :isheader)'; $stmt = $dbh->prepare($sql); if($_post['break'] != ""){ $isbreak = true; } else{ $isbreak = false; } $stmt->bindparam(':cat_name', $_post['cat_name']); $stmt->bindparam(':cat_description', $_post['cat_description']); $stmt->bindparam(':isheader', $isbreak); try{ $stmt->execute(); header('location: /testpage.php'); } catch(pdoexception $e){ $e->getmessage(); }
the above code should insert database column "break" being set "true"(or 1) when checkbox checked. doesnt. i've tried following if statements , none fixed it:
if(isset($_post['break']) == 1) if(($_post['break']) == "break") - ("break" being name of checkbox. if(($_post['break']) === "break") if(($_post['break']) == 'break')
now know code should work because before converted pdo php working. heres previous code looked like. 100% working how wanted to:
if(isset($_post['break']) == 1){ $isbreak = true; } else{ $isbreak = false; } $sql = "insert categories(cat_name, cat_description, isheader) values('" . mysql_real_escape_string($_post['cat_name']) . "', '" . mysql_real_escape_string($_post['cat_description']) . "', ". $isbreak.")"; $result = mysql_query($sql); if(!$result) { echo 'error' . mysql_error(); } else { header('location: /testpage.php'); };
i know of $_post data works because database filled correct "cat_name" , "cat_description" pdo code. i've had problem every page on site converting it. i've managed find dumb little work around specific each page, cant figure 1 out. i'd rather know why acting way is.
what's more when print_r($_post) , check box checked returns value "break". dont understand it.
why use string values $isbreak. gets put sql statement string anyway doesnt matter.
yes, matter.
the string 'true'
in integer context has value 0 in mysql. string-to-integer conversion happens implicitly takes leading digit characters string, , if there none, string has value zero.
whereas keyword true
equal integer 1.
here's demo of conversion. i'm adding + 0 force values converted integers.
mysql> select 'true' + 0; +------------+ | 'true' + 0 | +------------+ | 0 | +------------+ mysql> select true + 0; +----------+ | true + 0 | +----------+ | 1 | +----------+
in old code, put true
keyword insert statement, mysql server ended seeing following:
insert categories(cat_name, cat_description, isheader) values('name', 'description', true)
when true
inserted integer column, value inserted 1.
but when passing strings parameters, sent strings, works similar* following:
insert categories(cat_name, cat_description, isheader) values('name', 'description', 'true')
when 'true'
inserted integer column, value inserted 0.
re comment:
it makes no difference if you're using pdo or non-pdo. if interpolate unquoted string sql statement, parsed keyword. if pass string parameter, it's similar interpolating quoted string sql statement, , therefore 'true'
becomes 0 in integer context.
i worked more thorough test script. guess got answer, html form problem, not sql problem. i'll post test script here anyway future reference.
<?php $pdo = new pdo(..., array(pdo::attr_errmode=>pdo::errmode_exception)); $pdo->setattribute(pdo::attr_emulate_prepares, false); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 1: literal true', true)"); $stmt->execute(); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 2: literal \'true\'', 'true')"); $stmt->execute(); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 3: literal 1', 1)"); $stmt->execute(); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 4: literal \'1\'', '1')"); $stmt->execute(); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 5: param true', ?)"); $stmt->execute(array(true)); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 6: param \'true\'', ?)"); $stmt->execute(array('true')); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 7: param 1', ?)"); $stmt->execute(array(1)); $stmt = $pdo->prepare("insert foo (test, boolcol) values ('test 8: param \'1\'', ?)"); $stmt->execute(array('1'));
here's result:
+------------------------+---------+ | test | boolcol | +------------------------+---------+ | test 1: literal true | 1 | | test 2: literal 'true' | 0 | | test 3: literal 1 | 1 | | test 4: literal '1' | 1 | | test 5: param true | 1 | | test 6: param 'true' | 0 | | test 7: param 1 | 1 | | test 8: param '1' | 1 | +------------------------+---------+
* parameters never combined sql syntax, they're combined internal representation of query logic during execution, after sql has been parsed. that's why "similar."
Comments
Post a Comment