Question

I am trying to use the following code to get results from a get variable, I used another code (listed farther down) and it worked but there is no way to escape while using it, I don’t know what I have done wrong but I need help, I have just started PDO, so yes, I am an idiot 😀 but I want to learn.

if (isset($_GET['id'])) {
    $id = $_GET['id'];
    $q    = "SELECT * FROM users WHERE id=:id";
    $query = $odb->prepare($q);
    $results = $query->execute(array(
        ":id" => $id
    ));
    if($result-> rowCount()>0) {
        foreach($result as $item) {
            echo $item['user'];
        }
    }
}

The code that worked but didn’t have an escape:

$id = $_GET['id'];
$query = "SELECT * FROM users WHERE id=".$id."";
$result = $odb->query($query);
if($result->rowCount() > 0) {
    foreach($result as $item) {
        echo  $item['user'];
    }
}

Thanks and PS, if it is a stupid question not that I am barely 13 and I don’t think any question a 12 or 13 year old asks to do with code can be considered stupid. Please tell me what I did wrong.

Thanks!

Answer 1

if(isset($_GET['id'])){
    $id = $_GET['id'];

    $q = "SELECT * FROM `users` WHERE `id` = :id";
    $query = $odb->prepare($q);
    $query->execute(array(
        ':id' => $id
    ));

    if($query->rowCount() > 0){
        foreach($query->fetchAll() AS $item){
            echo $item['user'];
        }
    }
}

I did a bit of looking around and asked on phpfreaks, they told me that this would work, I tried it, it worked.