Question

Below is a function designed to handle a search scenario for a custom class.

I’ve already tripped over the fact that PDO defaults to binding parameters as strings, causing an integer->string conversion even if it’s not appropriate. As you’ll see, I corrected that by manually checking if the type is integer and then forcing the use of int in those cases. Problem is, my solution only works for a ‘start’ value of 0 — anything higher errors out, and I don’t know why. If I manually set the start/count values to their appropriate values ( i. e. instead of :count I use {$count}), everything works fine, so it looks like the binding is still messing up.

How? Or if I’m wrong… what is right?

    /*Query is:  
    SELECT tutor_school.id 
    FROM tutor_school, tutor_states 
    WHERE tutor_states.stateName=:state AND tutor_states.id=tutor_school.state 
    GROUP BY tutor_school.id order by tutor_school.name asc 
    LIMIT :start, :count*/

    $db = Database::get_user_db();
    $statement = $db->prepare($query);
    foreach ($executeArray as $key => $value)
    {
        if (getType($value) == 'integer')
        {
            $statement->bindParam($key, $executeArray[$key], PDO::PARAM_INT);
        }
        else
        {
            $statement->bindParam($key, $value);
        }
    }
    var_dump($executeArray);//count and start are still ints
    if ($statement->execute())
    {
        var_dump($executeArray);//start and count are now strings
        var_dump($statement->errorInfo());
        var_dump($query);
        $values = $statement->fetchAll();
        $return = array();
        foreach ($values as $row)
        {
            $school = School::schoolWithId($row[0]);
            if (!empty($school))
            {
                $return[] = $school;
            }
        }
        return $return;
    }

Answer 1

Metadata (such as the LIMIT arguments) can’t be parametrized. You will have to use (properly sanitized) interpolation instead.