查询看起来不错，但我有错误

Question

I have this SQL Query

$sql = $conn->prepare('INSERT INTO Accounts (Status, Username, Password, FirstName, LastName, EmailAddress, API_Status, API_Key, About) VALUES (:Status, :Username, :Password, :FirstName, :LastName, :EmailAddress, :API_Status, API_Key, :About)');
$sql->execute(array('Status' => 'NotActive', 'Username' => $Username, 'Password' => $PasswordHash, 'FirstName' => $FirstName, 'LastName' => $LastName, 'EmailAddress' => $EmailAddress, 'API_Status' => 'OFF', 'API_Key' => $API_Key, 'About' => $Other));      

When executing this query I'm using try { and

catch(PDOException $e) {
   echo $sql . "<br>" . $e->getMessage();
}

Now when I run script Iget this PHP error:

Catchable fatal error: Object of class PDOStatement could not be converted to string in /var/www/html/register.php on line 94

How I can slove this problem?

Answer 1

Problems with question.

1. Wrong naming. SQL is a text that is passed to prepare(). While returned value is an object. Problem not solved.
2. Due to wrong naming the OP is trying to echo an object. Problem not solved.
3. Thanks to the great site of Stack Overflow, the OP is taught terrible wrong way of handling PDO errors, with useless try..catch stuff. Problem not solved.
4. : is missed for one placeholder. The only problem solved.

As a result, next time this query throws an exception, THE SAME UTTERLY USELESS and irrelevant error message will be produced.

What should be done instead?

$sql = 'INSERT INTO Accounts 
    (Status, Username, Password, FirstName, LastName, EmailAddress,
     API_Status, API_Key, About) 
    VALUES (:Status, :Username, :Password, :FirstName, 
    :LastName, :EmailAddress, :API_Status, :API_Key, :About)';
$data = array(
    'Status' => 'NotActive', 
    'Username' => $Username, 
    'Password' => $PasswordHash, 
    'FirstName' => $FirstName, 
    'LastName' => $LastName, 
    'EmailAddress' => $EmailAddress, 
    'API_Status' => 'OFF', 
    'API_Key' => $API_Key, 
    'About' => $Other
);
$conn->prepare($sql)->execute($data);

What do we have here?

• proper naming. if one have a fancy of echoing an SQL query, they will be no mistaken.
• readability. No long and windy code off the screen, allowing us to visually inspect the query and find the syntax error.
• corrected placeholder syntax.
• no statement object is echoed. Neither SQL is, as it makes very little sense in case of a prepared statement.
• no stupid try..catch block. Means PHP will be able to notify PHP user in case of error occurred.