Question

I’ve never used PDO before, but decided finally that security is the primary concern and I have to switch from my familiar inbuilt mysql statements to something more secure. The db_connect() function in dbconn.php works just fine, pretty much copy and pasted from a PDO tutorial and tested with multiple SELECT statements successfully.

    include "dbconn.php";

    db_connect();

    //INSERT INTO  `a4331098_VAtest`.`VA_GPS` (`gID` , 'gtruck' , `gLat` , `gLong` , `gAlt` , `gTime`) VALUES (NULL , '434' , '47.558',  '-76.557',  '543',  '0111588448');
    $pTruck = $_POST['gTruck'];
    $pLat = $_POST['gLat'];
    $pLong = $_POST['gLong'];
    $pAlt = $_POST['gAlt'];
    $pTime = $_POST['gTime'];

    //echo $pTruck . "<br />" . $pLat . "<br />" . $pLong . "<br />" . $pAlt . "<br />" . $pTime . "<br /><br />";

    $stmt = $dbconn->prepare("INSERT INTO a4331098_VAtest.VA_GPS VALUES (NULL , ':fTruck' , ':fLat' , ':fLong' , ':fAlt' , ':fTime')");
    $stmt->execute(array(':fTruck' => $pTruck , ':fLat' => $pLat , ':fLong' => $pLong , ':fAlt' => $pAlt , ':fTime' => $pTime));
    $affected_rows = $stmt->rowCount();
    echo $affected_rows;

I know the correct values are being passed to the script (the commented out echo showed me that) but for some reason $affected_rows keeps returning 0. The structure of the DB is gID (being passed NULL, as it autoincrements), gTruck, gLat, gLong, gAlt, gTime. What am I doing wrong?

Answer 1

Try removing the quotes around the variables in your statement. PDO will insert them or not based on the type of value.