PHPFixing
  • Privacy Policy
  • TOS
  • Ask Question
  • Contact Us
  • Home
  • PHP
  • Programming
  • SQL Injection
  • Web3.0

Sunday, February 6, 2022

[FIXED] specifying mysqli bind_param types

 February 06, 2022     bindparam, mysqli, php     No comments   

Issue

what are the pros and cons of specifying mysqli bind_param types i,d,s,b?

I store a UNIX timestamp in a db column with data type INT. In my prepared statement I set it to bind_param('s',$timestamp); and it stores the value without any problems. So what impact did it make that I used s instead of i during bind_param?


Solution

It influences how MySQL will see the query/value. Take this query:

INSERT INTO foo VALUES (?)

If you bind the parameter as int:

$stmt->bind_param('i', $bar);

Then the query will be about equivalent to:

INSERT INTO foo VALUES (42)

However, if you bind as string:

$stmt->bind_param('s', $bar);

The query will be about equivalent to:

INSERT INTO foo VALUES ('42')

In many cases MySQL doesn't particularly care whether you send it a string or an int and will simply cast the value to the appropriate type on the fly, just as PHP does most of the time. However, in some circumstances and with some types you may get an unexpected conversion, which is why you should bind the value as the type that you want it as and not leave it up to MySQL's casting rules.



Answered By - deceze
  • Share This:  
  •  Facebook
  •  Twitter
  •  Stumble
  •  Digg
Newer Post Older Post Home

0 Comments:

Post a Comment

Note: Only a member of this blog may post a comment.

Total Pageviews

Featured Post

Why Learn PHP Programming

Why Learn PHP Programming A widely-used open source scripting language PHP is one of the most popular programming languages in the world. It...

Subscribe To

Posts
Atom
Posts
Comments
Atom
Comments

Copyright © PHPFixing