Question

I have a MySQL stored procedure like this

UPDATE `Discounts` SET `Occupation`=occupation,
`Organization`=organization,
`LastName`=lastName,
`FirstName`=firstName,
`Email`=email,
`Phone`=phone,
`Description`=description,
`ExpirationDate`=expiration,
`Notes`=notes 
  WHERE `ID` = id

and I’m calling it with this PHP

$occupation = $_POST["occupation"];
$organization = $_POST["organization"];
$last = $_POST["last"]; 
$first = $_POST["first"]; 
$email = $_POST["email"];
$phone = $_POST["phone"]; 
$description = $_POST["description"];
$notes = $_POST["notes"];
$expiration = date("Y-m-d H:i:s", strtotime($_POST["expiration"]));
$id = intval($_POST["id"], 10);

$password = $_POST["password"];

$mysqli = new mysqli("localhost", "xxx", $password, "xxxxxxxx");
if ($mysqli->connect_errno) {
    die("Could not connect");
}
$stmt = mysqli_stmt_init($mysqli);
if (mysqli_stmt_prepare($stmt, 'CALL UpdateDiscount(?,?,?,?,?,?,?,?,?,?)')) {
    mysqli_stmt_bind_param($stmt, "isssssssss", 
      $id, 
      $occupation, 
      $last, 
      $first,
      $email, 
      $phone, 
      $description,
      $organization,
      $notes,
      $expiration);
  mysqli_stmt_execute($stmt);
  mysqli_stmt_close($stmt);
  echo "Success!";
}

The update works exactly as I expected except that it updates every single row instead of the one row corresponding to the ID. I can’t understand why this is happening, I have a WHERE 'ID'=id check. What is going on? How can I make it so that it only updates a single row?

Answer 1

In stored procedures, when a name conflict occurs between field and parameter names, the parameters are used.

Your query is parsed as:

UPDATE  ...
WHERE   :id = :id

which is always true (unless you pass a NULL)

Prepend the parameter names with an underscore:

CREATE PROCEDURE myprc (_id, _occupation, ...)
AS
BEGIN
        UPDATE  mytable
        SET     occupation = _occupation
        WHERE   id = _id;
END;