Question

I’m trying to update a table using this query but does not seem to work.

  $query="UPDATE product SET qty = (qty - '$qty') WHERE barcode = '$barcode'";  
  $result = $this->db->conn_id->prepare($query);
  $result->execute();  

I’ve tried placing the query inside a try catch block but it does not throw any error. The issue is with the implementation in CodeIgniter as this query is working when executed outside codeigniter.

Answer 1

Looking at your code there are a few things.

You aren’t using the prepared statement right. The benefit to using a prepared statement is passing in the variables you need with a different function so you can escape them correctly. Consider the following:

$query="UPDATE product SET qty = (qty - ':qty') WHERE barcode = ':barcode'";  

$stmt = $this->db->conn_id->prepare($query);

$stmt->bindParam(':qty', $qty, PDO::PARAM_STR);
$stmt->bindParam(':barcode', $barcode, PDO::PARAM_STR);

$stmt->execute();  

echo "Rows affected: " . $stmt->rowCount();

Here we take the query and setup the parameters within. Then we bind the variables to the statement so they are escaped properly. After that we can execute the statement and then use the fetch() function to get our response. The enumeration passed in will return the results as an associative array.