尝试用准备好的声明回应

Question

I am trying to go from mySQL (about time?) to PDO - but I am having trouble in making sense of how things are supposed to be written. I want to be protected from injection, but I just can't figure out how to do it properly. It just seems so confusing. It might be because I'm doing it COMPLETELY wrong?

Been looking around for help on various sides doing tutorials, but :(

Any chance someone could assist me? Explain/show like I'm five?

<?php
$col_playername = "playername";
$tbl_playerdata = "player_data";
$post_search = "$_POST[search]";

$sth = $dbh->prepare("SELECT :col_playername FROM :tbl_playerdata
                WHERE :col_playername LIKE %:post_search%
                LIMIT 5");

$sth->bindParam(":col_playername", $col_playername);
$sth->bindParam(":tbl_playerdata", $tbl_playerdata);
$sth->bindParam(":post_search", $post_search);  

$sth->execute();

foreach ($sth as $row)
{
    ?>
    <div id="search_show">
        <a href="?target=<?php echo $row["playername"]; ?>"><?php echo $row["playername"]; ?></a> 
    </div>
    <?php
}
?>

As of right now - nothing is coming out. I wouldn't be surprised if this is absolutely wrong.

Answer 1

$statement->execute() will execute, but not fetch your rows.

You need to add either $statement->fetch() to get one result set, or $statement->fetchAll to get an array:

$sth->execute();

$rows = $sth->fetchAll();

foreach ($rows as $row)
{
    //do stuff
}

Note: Since you are handling your results as associative arrays, you should this before preparing anything. It will save you from specifying the fetch mode with every single fetch().

$dbh->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC);