Passing string and variable to php function

Question

I have a script that manage my tables and contains function to get list or to get certain data by id. Right now one of my functions looks like this

//Returns a Series Object matching the given series id
public static function getById( $WHERE, $id ){
    $conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
    $sql = "SELECT * FROM series $WHERE $id";
    $st = $conn->prepare( $sql );
    $st->execute();
    $row = $st->fetch();
    $conn = null;
    if( $row ) return new Series( $row );
}

But I want it to be like this

//Returns a Series Object matching the given series id
public static function getById( $statement ){
    $conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
    $sql = "SELECT * FROM series $statement";
    $st = $conn->prepare( $sql );
    $st->execute();
    $row = $st->fetch();
    $conn = null;
    if( $row ) return new Series( $row );
}

So instead of having to do this

$series = Series::getById( ( string ) "WHERE id=", (int) $_POST['seriesId'] );

I can do this

$series = Series::getById( ( string ) "WHERE id=$_POST['seriesId']" );

You should use prepared statements.

chris85
– chris85

2015-10-19 01:12:54 +00:00
Commented Oct 19, 2015 at 1:12 — chris85
– chris85, Commented Oct 19, 2015 at 1:12

Ali MasudianPour · Accepted Answer · 2015-10-19 00:46:12Z

1

The correct way of passing that value to your function would be like below:

$series = Series::getById("WHERE id=".$_POST['seriesId']);

answered Oct 19, 2015 at 0:46

Ali MasudianPour

14.5k3 gold badges64 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Passing string and variable to php function

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related