PDO查询不起作用

Question

我已经看了几个小时的相同代码，试图找出为什么我的查询不起作用。我下面列出的两个是不工作的两个。

$getRequestIdQuery = "SELECT request_id 
    FROM request_table 
    WHERE request_key = '$requestKey' 
    AND sort_order = $so"; 

$getRequestId = $pdo->prepare($getRequestIdQuery); 
$getRequestId->execute(); 
foreach($getRequestId as $idRow) 
{ 
    $requestId = $idRow['request_id']; 
} 

// This will update the ready status of the request id returned above 
$updateReadyStatusQuery = "UPDATE request_table 
    SET request_ready = 1 
    WHERE request_id = $requestId"; 
$updateReadyStatus = $pdo->prepare($updateReadyStatusQuery); 
$updateReadyStatus->execute(); 

上述情况在文件副本返回true时运行。我已经确定这是在运行，因为在每次测试运行期间都会显示上面的错误日志。我也确定有问题的查询工作正常，因为我在phpmyadmin中成功运行了查询（如错误日志中显示的那样）。以下是上面的代码只有这几行代码，可运行正常：

$checkForComposedQuery = "SELECT * 
    FROM composed_files 
    WHERE file_source_id = '$fsi' 
    AND file_number = '$fn'"; 

$checkForComposed = $pdo->prepare($checkForComposedQuery); 
$checkForComposed->execute(); 

任何提示，以什么可能会导致这不行？如果有帮助，上述两个片段都在foreach循环中发生。

非常感谢提前。

UPDATE：

下结合的代码，其中包括由以下查尔斯补充建议：

$gotCopied = copy($sourceHymnFile, $destHymnFile); 

if ($gotCopied == true) { 
    error_log("The file has been successfully copied."); 

    $idRow; 
    $getRequestIdQuery = "SELECT request_id 
     FROM request_table 
     WHERE request_key = ? 
     AND sort_order = ?"; 
    $getRequestId = $pdo->prepare($getRequestIdQuery); 
    $getRequestId->execute(array($requestKey, $so)); 
    error_log("this is the value of request key : ".$requestKey); 
    // Displays correct $requestKey value 
    error_log("This is the value of sort order : ".$so); 
    // Displays correct $so value 
    $idRow = $getRequestId->fetch(PDO::FETCH_ASSOC); 
    $requestId = $idRow['request_id']; 
    error_log("This is the value of the request id : ".$requestId); 
    // No output in error log for $requestId above 

    // This will update the ready status of the request id returned above 
    $updateReadyStatusQuery = "UPDATE request_table 
     SET ready = 1 
     WHERE request_id = ?"; 
    error_log("This updates the status of the song request if the song is played : ".$updateReadyStatusQuery); 
    $updateReadyStatus = $pdo->prepare($updateReadyStatusQuery); 
    $updateReadyStatus->execute(array($requestId)); 
} 

以下为进入正常运行正常常量：

if ($gotCopied == true) { 
    error_log("The file has been successfully copied."); 

    $idRow; 
    $getRequestIdQuery = "SELECT request_id 
     FROM request_table 
     WHERE request_key = ? 
     AND sort_order = ?"; 
    $getRequestId = $pdo->prepare($getRequestIdQuery); 
    $getRequestId->execute(array(5, 2)); 
    error_log("this is the value of request key : ".$requestKey); 
    error_log("This is the value of sort order : ".$so); 
    $idRow = $getRequestId->fetch(PDO::FETCH_ASSOC); 
    $requestId = $idRow['request_id']; 
    error_log("This is the value of the request id : ".$requestId); 
    // No output in error log for $requestId above 

    // This will update the ready status of the request id returned above 
    $updateReadyStatusQuery = "UPDATE request_table 
     SET ready = 1 
     WHERE request_id = ?"; 
    error_log("This updates the status of the song request if the song is played : ".$updateReadyStatusQuery); 
    $updateReadyStatus = $pdo->prepare($updateReadyStatusQuery); 
    // This execute works correctly if a value is set for $requestId 
    $updateReadyStatus->execute(array($requestId)); 
} 

Answer 1

你有两个问题这里。

首先，占位符和绑定。你的代码很容易被SQL注入。 PDO包含一个工具来帮助减轻这种威胁。

$getRequestIdQuery = "SELECT request_id 
    FROM request_table 
    WHERE request_key = ? -- new! 
    AND sort_order = ?"; 

$getRequestId = $pdo->prepare($getRequestIdQuery); 
$getRequestId->execute(array($requestKey, $so)); 

查询中的?是占位符。传递给execute的数组提供了任何占位符的替换列表。它们会根据需要自动转义并引用。

其次，您检索结果不正确。您需要在语句句柄上调用fetch method（或fetchAll method）。例如：

$idRow = $getRequestId->fetch(PDO::FETCH_ASSOC); 
$requestId = $idRow['request_id']; 

请注意，这里没有循环。你以前的循环会预期有多个结果，但它会在每个循环中重写相同的变量。看起来你只需要一个结果，所以你只需要担心一个结果。

我们还应该更新您的其他查询以使用占位符。

$updateReadyStatusQuery = "UPDATE request_table 
    SET request_ready = 1 
    WHERE request_id = ?"; 
$updateReadyStatus = $pdo->prepare($updateReadyStatusQuery); 
$updateReadyStatus->execute(array($requestId)); 

...和你的第三个......

$checkForComposedQuery = "SELECT * 
    FROM composed_files 
    WHERE file_source_id = ? 
    AND file_number = ?"; 

$checkForComposed = $pdo->prepare($checkForComposedQuery); 
$checkForComposed->execute(array($fsi, $fn));