Validating SQL query with PHP

Question

The validation seems to fail for some reason. By the validation, I mean the "if ($result)" -part. How can I correctly validate SQL-query?

$dbconn = pg_connect("host=localhost port=5432 dbname=heoa user=heoa password=123");
$email  = $_POST['login']['email'];

$result = pg_query_params( $dbconn,
                'SELECT user_id
                FROM users
                WHERE email = $1',
                array( $email )
                );
if ($result)
{
        while ( $row = pg_fetch_array( $result ) )
        {
                $user_id = $row['user_id'];
        }
        return $user_id;
}

Cellfish · Accepted Answer · 2009-09-06 16:14:20Z

2

I suspect that the return value is integer zero which is also interprested as false in the if statement. By doing "if ($result !== FALSE)" (Note that it should be !== and not !=) you'll verify if the result really is different than FALSEand not just false...

answered Sep 6, 2009 at 16:14

Cellfish

2,22218 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Daniel Vérité Over a year ago

This can't be correct because per documentation, pg_query_params returns A query result resource on success or FALSE on failure. This code is correct except that it should call pg_last_error() to know why the db failed on that query.

David Andres · Accepted Answer · 2009-09-06 17:00:56Z

0

Should you add apostraphe's around $1 in your SQL query, as in?

SELECT user_id
FROM users
WHERE email = '$1'

I'm not sure how PHP expands the $1 variable.

answered Sep 6, 2009 at 17:00

David Andres

31.8k7 gold badges48 silver badges36 bronze badges

2 Comments

Bill Karwin Over a year ago

(a) PHP doesn't expand variables in single-quoted strings. (b) Using the $1 parameters is correct usage in the pg API. (c) Don't put query parameters in quotes, because they'll be interpreted as literal strings in the SQL expression, instead of parameters.

David Andres Over a year ago

thanks, I wasn't sure. I haven't coded PHP pages in at least five years so the rust is pretty thick if you get my gist

Collectives™ on Stack Overflow

Validating SQL query with PHP

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related