I have an HTML page through which I will be getting user input. I am taking those values and performing a query on my mysql database. This is my PHP code which does so.
<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);
$username = "xxx";
$password = "xxx";
$A = $_POST['A'];
$B = strtoupper($_POST['B']);
$C = $_POST['C'];
$D = $_POST['D'];
$E = $_POST['E'];
$F = $_POST['F'];
try {
$conn = new PDO('mysql:host=yyyy;dbname=' . $A, $username, $password);
echo "Connected Successfully <br>";
} catch (PDOException $e) {
print "ERROR! : " . $e->getMessage() . "<br/>";
die();
}
$query = "call query(?,?,?,?,?,1,'filename.txt')";
$stmt = $conn->prepare($query);
$stmt->execute(array($B, $C, $D, $E, $F));
?>
This code throws no errors, but the script is not doing the job it's supposed to do. If I go into the mysql database and perform the query
call query(r_value,r_value,r_value,r_value,r_value,1,'filename.txt') ;
it creates a file with the filename and does the writing job perfectly. Using PHP the same result is not being achieved, but I am not seeing any errors thrown as well.
The job of this query procedure is to perform some queries based on input and write the results onto an output file whose location is passed as a parameter. Thanks in advance
Note: I also tried adding ';' in the $query but it made no difference.
edit: when i am using simple query instead of prepared statements it seems to work but i am not willing to use simple statements because of SQL injection