Question

I know the title sounds ludicrous but I’ve done research for hours now only to figure out that PDO is ultimately buggy with no obvious solution…I am dedicated to being open for one. I’m also willing to accept that my code is flawed.

Using PHP 5.2/Ubuntu, this code works (not using prepared statements/open to injection):

$sql ="SELECT COUNT(*) FROM property p
INNER JOIN property_attribute pa ON p.property_id = pa.property_id
INNER JOIN property_area pc ON p.property_id = pc.property_id
WHERE pa.attribute_value_id
    IN (
        SELECT av.attribute_value_id
        FROM attribute_value av
        INNER JOIN attribute a ON av.attribute_id = a.attribute_id
        WHERE a.name LIKE '$attributes'
        AND av.value LIKE '$values'
    ) 
ORDER BY p.price ASC";
$params = array();
$rHowManyPages = Listings::HowManyPages($sql, $params);

However, using PDO’s wonderful prepared statements:

$sql ='SELECT COUNT(*) FROM property p
INNER JOIN property_attribute pa ON p.property_id = pa.property_id
INNER JOIN property_area pc ON p.property_id = pc.property_id
WHERE pa.attribute_value_id
    IN (
        SELECT av.attribute_value_id
        FROM attribute_value av
        INNER JOIN attribute a ON av.attribute_id = a.attribute_id
        WHERE a.name LIKE :attributes
        AND av.value LIKE :values
    ) 
ORDER BY p.price ASC';
$params = array(':attributes' => $attributes, ':values' => $values);
$rHowManyPages = Listings::HowManyPages($sql, $params);

It works, kinda. Here’s the Spartanic madness part: 1 in 5 refreshes of the same data being passed, PDO gives this error:

TEXT: SQLSTATE[HY093]: Invalid parameter number

It’s random! How and why?

Answer 1

Is it possible that one of the values supplied for the named arguments contains a question mark in it? I ran across a problem with that, but that was a long time ago. (I certainly expect they would have that fixed by now.)

In my limited experience, PDO support for “named arguments” is somewhat sketchy.

For one thing, you can’t use the same named argument in multiple places in a statement, the placeholder name for each named argument must be unique, and can only be used once. And that blows one of the big benefits of named arguments right out of the water.

I believe that the problem I encountered with the question mark character in a value, and the inability to reference a named argument more than once (I haven’t confirmed this) is due to PDO “named argument” support being a bolt-on afterthought to the support for positional arguments; essentially, it looks like the “named arguments” are getting translated into positional arguments.

I also encountered some wonkiness when the named arguments included underscore characters.

My workaround was to (ACCCKKK!) use positional arguments instead of named arguments.

(As much as I am loathe to use positional arguments, it worked for me.)

(I don’t see anything wrong in the code you show that would account for the observed behavior. Obviously, there is other code that you aren’t showing.)

Also, you might want to verify that your $params array contains only the two elements; I had the same error message when my array had an “extra” unmatched element. Then again, in my code, I dropped back to using just scalars, and binding each one separately, rather than having PDO muck it up. (Wasn’t a problem for me, that’s the pattern I’m overly familiar with in Perl DBI. Rather than muck with debugging the problems, I worked around them.)

---

NOTE: By positional arguments, I mean using a question mark in place of a name:

 $sql = " ...
  WHERE a.name LIKE ?
    AND av.value LIKE ?
 ... ";

$sth->bindParam(1, $attributes);
$sth->bindParam(2, $values);