为什么我收到PDO查询错误？

Question

Apologies in advance because I'm really unsure how to ask this question so if you need to know anything then please comment rather than downvote and I will edit.

I have teaser links on my main page which when clicked open up a window with the full article. I'm currently converting my MySQL code over to PDO and have gotten a little stuck.

In MySQL I used to be doing the following (Here, $foo_query is the query from the first page):

$id = $_GET['id'];

$sql = "SELECT id, postdate, title, body FROM FooBarTable WHERE id = $id";
if ($foo_query = mysql_query($sql)) {
    $r     = mysql_fetch_assoc($foo_query);
    $title = $r["title"];
    $body  = $r["body"];
}

Which is simple to understand to me. I've been trying to convert this using what I know, and it turns out I don't know very much. So far I have the following:

$id = $_GET['id'];

$sql = $DBH->prepare("SELECT id, postdate, title, body FROM FooBarTable WHERE id = :id OR id = $id");
$sql->bindParam(':id', $_REQUEST['id'], PDO::PARAM_INT);
if ($foo_query = $DBH->query($sql)) {
    $r->setFetchMode(PDO::FETCH_ASSOC);
    $r     = $foo_query->fetch();
    $title = $r["title"];
    $body  = $r["body"];
}
$sql->execute();

This brings up an error of 'PDO::query() expects parameter 1 to be string'. This is for the 'if' line.

Have I even written any of that PDO correctly? What would I need to do from here? A friend has recently taught me MySQL, but he doesn't know PDO at all which means I can't ask his advice (not all that helpful...)

Answer 1

This is the correct way, with comments:

try {
    //Connect to the database, store the connection as a PDO object into $db.
    $db = new PDO("mysql:host=localhost;dbname=database", "user", "password");

    //PDO will throw PDOExceptions on errors, this means you don't need to explicitely check for errors.
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    //PDO will not emulate prepared statements. This solves some edge cases, and relives work from the PDO object.
    $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

    //Prepare the statement.
    $statement = $db->prepare("SELECT id, postdate, title, body FROM FooBarTable WHERE id = :id");
    //Bind the Value, binding parameters should be used when the same query is run repeatedly with different parameters.
    $statement->bindValue(":id", $_GET['id'], PDO::PARAM_INT);
    //Execute the query
    $statement->execute();

    //Fetch all of the results.
    $result = $statement->fetchAll(PDO::FETCH_ASSOC);
    //$result now contains the entire resultset from the query.
}
//In the case an error occurs, a PDOException will be thrown. We catch it here.
catch (PDOException $e) {
    echo "An error has occurred: " . $e->getMessage();
}