mardi 23 décembre 2014

How can I use parameterized PHP PDO to drop a MySQL event?




public function dMySQLEvent($my_env, $my_event_name) {

$my_success = 0;
$my_message = '';

try {

# declare & set variables using $my_env
list ($db_dbdriver, $db_hostname, $db_database, $db_username, $db_password) = Connection::dbConnect($my_env);

# set default timezone

# create & set connection

# WORKS
# $conn->exec("DROP EVENT IF EXISTS " . $my_event_name . ";");

# DOES NOT WORK
# Prepare an SQL statement
$my_sql = "DROP EVENT IF EXISTS :My_Event_Name";
$stmt = $conn->prepare($my_sql);

# bind parameters to prevent SQL Injection
$stmt->bindValue(':My_Event_Name', $my_event_name);

# execute the SQL statement
$stmt->execute();

# closes the cursor, enabling the statement to be executed again
$stmt->closeCursor();

# close & unset the connection
$stmt = null;
unset($stmt);
$conn = null;
unset($conn);

# Set success value to TRUE
$my_success = 1;
$my_message = 'success';

} catch(PDOException $e) {

# Append error message to error log

}

return array($my_success, $my_message);

}




Aucun commentaire:

Enregistrer un commentaire