Question

I am in the process of converting our site from the PHP Mysql API to PDO, and have run into an issue with data types.

Previously, we escaped all of our variables as if they were strings. for example,

SET varname = '$varvalue'

Now, with PDO, of course, I do

SET varname = :varvalue

then we have a class that handles binding of the value of $varvalue, setting the data type based on the type of the variable.

The problem for us comes when varname is supposed to be a string, and $varvalue is, for some reason, null. previously, ‘$varvalue’ would have just become ” when $varvalue is null. Now, we are “properly” binding $varvalue as null, but the database field does not allow null.

I know that the most correct way to fix this would be to ensure that $varvalue comes into the function with the correct value, but we have a large legacy code base, and that would be really a lot of work to implement. Another solution would be to explicitly cast every variable when we bind it to the correct type. We’d prefer a solution that avoids us having to explicitly cast every variable in our models, if possible. Is there one?

Answer 1

Since previously you did not mind having empty strings, why not just checking if var value is null or not?

$stmt->bindParam(':varvalue', (is_null($varvalue) ? '' $varvalue), PDO::PARAM_STR);