Question

Question: Is there an easier /safer way of running more complex SQL queries in Fat Free Framework. The solution I have is to use PDO, but it’s messy and ugly as I can’t throw exceptions easily.

Background:

Fat Free provides the AXON class for “safe” manipulation of databases, but I want to do a more complex query that AXON can handle.

The DB class is exposed, but I would need to resort to “mysql_real_escape_string()” to build queries which is not guaranteed safe. So the solution appear to be using the exposed PDO.

The exposed PDO as default error handling, which is a pain and results in ugly code.

        $pdo = F3::get('DB')->pdo;
        $sql = 'INSERT INTO config(config_name, config_value, comments) VALUES( :config_name , :config_value , :config_comments)
                     ON DUPLICATE KEY UPDATE config_value= :config_value2';
        if (!$stmt = $pdo->prepare($sql)) {
            $errorInfo = $pdo->errorInfo();
            trigger_error('PDO Error: ' . $pdo->errorCode(). ' ' . $errorInfo[2]);
            exit();
        }

        $stmt->bindValue(':config_name', $field, PDO::PARAM_STR);
        $stmt->bindValue(':config_value', $value, PDO::PARAM_STR);
        $stmt->bindValue(':config_comments', $comments, PDO::PARAM_STR);
        $stmt->bindValue(':config_value2', $value, PDO::PARAM_STR);
        if ($stmt->execute() === false) {
            $errorInfo = $stmt->errorInfo();
            trigger_error('PDO Error: ' . $stmt->errorCode(). ' ' . $errorInfo[2]);
            exit();
        }

So is there something neater that I’m missing? Or can AXON handle more complex queries?

Answer 1

Have you looked into the DB object and writing parameterized queries? You can view the docs here, and tab down to Parameterized Queries.

It’s a little cleaner than messing directly with PDO.

DB::sql(
    'SELECT * FROM users WHERE userID=:uID',
    array(':uid'=>array(F3::get('POST.userID'),PDO::PARAM_INT))
);