如何使用pdo prepare语句实现此目的

Question

In mysqli server I use this code below to select column specified by the url code:

       include "init.php";

       $get=$_GET["action"];

       $sql = mysqli_query($conn, "SELECT * FROM $get ORDER BY id DESC LIMIT 6");

       $productCount = mysqli_num_rows($sql); // count the output amount

       if ($productCount > 0) 
       {

       while($row = mysqli_fetch_array($sql)){

       $id = $row["id"];

       $jjode = $row["code"];

       $product_name = $row["network"];

       $details = $row["details"];

       $logo = $row["logo"];

       $price = $row["price"];

       }

i try using it in my pdo server like code:

       include "init.php";

       $get=$_GET["action"];

       $sql = $conn->prepare("SELECT id,code,network,details,logo,price FROM $get ORDER BY id DESC LIMIT 6");

       $sql->execute();

       $row = $sql->fetchAll();
        if(count($row) > 0)

       {

       $id = $row["id"];

       $jjode = $row["code"];

       $product_name = $row["network"];

       $details = $row["details"];

       $logo = $row["logo"];

       $price = $row["price"];

       }

but it did not output a better result please how do i achieve that using pdo thanks in advance

Answer 1

Both of code listings are not safe. Use whitelist for $get.

You should loop result of fetchAll

$rows = $sql->fetchAll();
foreach ($rows as $row)

{

   $id = $row["id"];

   $jjode = $row["code"];

   $product_name = $row["network"];

   $details = $row["details"];

   $logo = $row["logo"];

   $price = $row["price"];

}