Here is what I get if I use my first section of code:
SQL: [45] SELECT id FROM users WHERE username = ':name' Params: 8
From this, we see that you're quoting the parameter (don't) and passing too many parameter values. One is defined, you pass eight.
@Misson: If I used the array_intersect_key() method you talked about, which two arrays would I be comparing?
You should be able to figure this one out. You only want certain entries from the input array, those that are named parameters. Thus you intersect the input array and an array defining which keys:
PHP:
$sth->execute(array(array_intersect_key($info, array(':name' => null)));
However, in this case, using a single positional parameter is simple and clear, so that's what you should do.
Another alternative (not to be used in this case) is to use
PDOStatement::bindParam or
PDOStatement::bindValue, then call
execute() with no arguments.
bindParam is particularly useful when executing the query multiple times and the value is always stored in the same variable; you can bind the parameter once and simply change what's stored in the variable.
Also, was that the right way to do the :key? Or do I have to place ' 's around it to turn it into a string?
Parameters are unquoted, just like variables are unquoted in other languages (you wouldn't write
strtolower('$action'), would you?). Again, the
documentation covers this; take a closer look at it. Remember, the point of using quotes when you interpolate a value is to delineate the embedded data, to separate it from the
host language.
Edit 1: I changed it a little bit, now I get a blank screen when I try.
The fragment you posted only outputs something when there's an error. Perhaps the blank screen is an indication that the query succeeded, and the user name is available. Print something (e.g.
"Username $info[:name] is available.") on success so you can tell.
The call to
PDOStatement::rowCount should be within the try block. If an exception is thrown,
$sth won't hold valid results, and any calls on it that deal with results are meaningless. You need to consider what's valid and what isn't when thinking about errors.
PHP:
$sth = $dbh->prepare("SELECT username FROM users WHERE username = '{$name}' ");
One of the two main points behind prepared statements is to avoid doing just this, in order to prevent SQL injection. You need to study more.
You defined a variable inside the array variable. Is that correct. [...] Also, how do I call those variables onto the script? Is it $info['$name'] or something?
$name = 'value' is an expression (i.e. it has a value), distinguished from statements (e.g.
if statements), which don't have values (read "
Expressions vs Statements" and "
Expression Versus Statement" for more). It's the value of the expression that gets stored in the array, where indices get assigned as all integer indices are assigned. You'd refer to it as
$info[0].
Docttor uses in the same way as:
PHP:
$db->prepare($stmt = "SELECT ...");
// Note: assignment, not comparison
while (($row = $query->fetch())) {
...
}
/* Note this is better written as:
foreach ($query->fetch() as $row) {
but it serves to illustrate the use of assignment expressions.
*/
And why do you need to use {$name} for that?
The braces are for
interpolating "complex" expressions, such as
$foo->bar->baz(). In this case they're not necessary, as
$name isn't a "complex" expression, but they do make it stand out more in the string.
ass paramno=-1 name=[5] "