pdo binding parameters with $_POST()

Question

I m having a issue with binding paramters in PDO. This problem happens if I want to use two out parameters from a javascript. With the use of .AJAX the variables are send to the PHP script.(I tested of the javascript variables are available in my PHP script and they were indeed.)

I don't get a error message when I use this variables but the SQL isn't executed. When I replace the javascript variables with a integer like '12344' it works. The code that i m using is:

session_start();
$user = 'postgres';
$pass = 'baf45baf';
$dans = $_SESSION['dans_code'];

if( isset($_POST['ycoord'], $_POST['xcoord']) ) {
$dbh = new PDO("pgsql:host=localhost;dbname=import", $user, $pass);
$sql = 'UPDATE geom_tijd SET x_coord= :x_coord, y_coord= :y_coord WHERE dans_code = :code';
$stmt = $dbh->prepare($sql);
$stmt->bindParam(':code', $dans);
$stmt->bindValue(':y_coord', $_POST['ycoord'],PDO::PARAM_INT);
$stmt->bindValue(':x_coord', $_POST['xcoord'],PDO::PARAM_INT);
$stmt->execute();

if (!$stmt) {
    echo "\nPDO::errorInfo():\n";
    print_r($dbh->errorInfo());
}

if($stmt->rowCount() == 0){
    echo "failure";
} else {
    echo "victory";

}
}

If I echo the xcoord I get '212562.46720' and the ycoord '520411.55763'.

The $dans variable is a variable that I'm getting from $_SESSION['dans_code']; This variable is from a php script earlier and its working if I'm only using this variable.

This is the part of my javascript that get and also send the javascript value. The values are the x and y coordinates from the mouseposition onclick in the map. This is not the best way to get this variables but it works.

map.on('click', function() {
var show = document.getElementById("location").innerHTML;
var show_schoonmaken = show.replace('<div class="custom-mouse-position">',"");
var show_klaar = show_schoonmaken.replace('</div>',""); 
var show_done = show_klaar.replace(' ',""); 
var split = show_done.split(',');

document.getElementById("y_coördinaat").value = split[1];
document.getElementById("x_coördinaat").value = split[0];

    $.ajax({
        url: 'update_coordinates.php', //This is the current doc
        type: "POST",
        data: ({xcoord: split[0],ycoord: split[1]}),
        success: function(data){
            console.log(data);
            alert(data);
        }
    }); 
});

you're not checking for errors anywhere and we don't know what the rest of your code (JS/HTML) looks like. Look at your console also. — Funk Forty Niner, Apr 25 '16 at 12:34
*"The $dans variable is a variable that i m getting from $_SESSION['dans_code'];"* so... did you start the session? Too many unknowns here. — Funk Forty Niner, Apr 25 '16 at 12:36
From the docs seems like you need to add a data type in the bind call? e.g. http://stackoverflow.com/questions/2718628/pdoparam-for-type-decimal suggests using PDO::PARAM_STR for a float. Also what does echo $_POST['ycoord'], $_POST['xcoord'] give you. — Anthony, Apr 25 '16 at 12:45
all nice and dandy, but you didn't tell us about any errors if you're checking for them at all (which doesn't seem like it), or what the console says. — Funk Forty Niner, Apr 25 '16 at 12:46
i dont get any errors in my console. And with the test with print_r($dbh->errorInfo()); i dont get any errors but my database isn't updated — B.Termeer, Apr 25 '16 at 12:47
@Anthony i added the echo and i tried the PDO:PARAM_STR. Still nothing — B.Termeer, Apr 25 '16 at 12:54
My link suggests you should be using PDO:PARAM_STR where did you add the echo, it should be as close to the top as possible, perhaps just before or just after the isset statement. what was the output. — Anthony, Apr 25 '16 at 17:57

score 0 · Answer 1 · answered Apr 28 '16 at 17:24

From the docs seems like you need to add a data type in the bind call? e.g. stackoverflow.com/questions/2718628/pdoparam-for-type-decimal suggests using PDO::PARAM_STR for a float. Also what does echo $_POST['ycoord'], $_POST['xcoord'] give you.

The above link suggests you should be using PDO:PARAM_STR where did you add the echo, it should be as close to the top as possible, perhaps just before or just after the isset statement. It would be helpful if you could post the output from that echo statement if you continue to face problems.

pdo binding parameters with $_POST()

1 Answers1