Question

I have the following PHP code doing a very simple select into a table.

$statement = $db->prepare("SELECT * FROM account WHERE fbid = :fbid");
$statement->bindParam(":fbid",$uid, PDO::PARAM_STR,45);
$out = $statement->execute();
print_r($out) // 1;
//$out = $statement->execute(array(':fbid' => $uid)); // also doesn't work
$row = $statement->fetch();

$out is true (success) yet $row is null.

EDIT:

$statement->debugDumpParams();

Outputs

SQL: [40] SELECT * FROM account WHERE fbid = :fbid Params: 1 Key: Name: [5] :fbid paramno=-1 name=[5] ":fbid" is_param=1 param_type=2

If I modify the code as follows:

$statement = $db->prepare("SELECT * FROM account WHERE fbid = $uid");
$out = $statement->execute();
$row = $statement->fetch();

$row contains the record I’m expecting.

I’m at a loss. I’m using the PDO::prepare(), bindParams() etc to protect against SQL Injection (maybe I’m mistaken on that).

EDIT:
In my example, $uid is a numerical string (ie a string containing only numbers). In the database, the column type is VARCHAR(45)

EDIT:

If I change the database type from VARCHAR(45) to BIGINT, both queries work. If I change the type in the database type back to VARCHAR(45) again, it works. So what gives?

Please halp.

Answer 1

I think there may be an issue with your PDO installation.

$uid = 552192373; // my facebook uid for testing
$statement = $db->prepare("SELECT * FROM users WHERE facebook_uid = :fbid");
$statement->bindParam(":fbid",$uid, PDO::PARAM_STR,45);
$out = $statement->execute();
$row = $statement->fetch(PDO::FETCH_ASSOC);
echo '<pre>';
print_r($row);
echo '</pre>';

returns:

Array
(
    [id] => 1
    [facebook_name] => Jason Boehm
    [facebook_uid] => 552192373
)