Question

Possible Duplicate:
MySQL / PDO / Prepared Statements – All a big jump, a bit overwhelming and a little confusing?

I am using this code to insert data into a users table. It works fine unless the users last name contains an apostrophe (ex. O’Toole). It is my understanding that PDO prepared statements should handle the apostrophe with no additional work on my part. Is my assumption incorrect and that is why this code does not work for names with apostrophes?

I am not getting an error message.

require_once('/database/database.php');
$query = "INSERT INTO users
             (first_name,last_name, email, pass, reg_date)
          VALUES
             ('$fn','$ln','$em', SHA1('$pwd'), NOW())";

try {
    $statement=$db->prepare($query);
    $statement->bindValue(':first_name',$fn);
    $statement->bindValue(':last_name',$ln);
    $statement->bindValue(':email',$em);
    $statement->bindValue(':pass',SHA1('$pwd'));

    $success = $statement->execute();
    $row_count = $statement->rowCount();
    $statement->closeCursor();

Answer 1

You are not using the bind correctly, try this:

$query = "INSERT INTO users
         (first_name, last_name, email, pass, reg_date)
      VALUES
         (:first_name, :last_name, :email, :pass, NOW())";

You ‘bind’ your values to the placeholders in the query.