将参数传递给存储过程

Question

I'm getting following error

SQLSTATE[42000]: [Microsoft][ODBC Driver 11 for SQL Server][SQL Server]Must pass parameter number 44 and subsequent parameters as '@name = value'. After the form '@name = value' has been used, all subsequent parameters must be passed in the form '@name = value'.

and this is my code

$pdowin->beginTransaction();
    try {
        // headers
        $rows = $pdo->query("SELECT * FROM orders WHERE status = 2 AND productId IS NOT NULL GROUP BY id");
        // fetch the rows
        while ($row = $rows->fetch(PDO::FETCH_ASSOC)) {
            $pdowin->query("EXEC sp_salesorderimport
                @salesordernumberid = ".$row['id'].",
                    ... // number of other params here
                ");

            // items
            $items = $pdo->query("SELECT * FROM orders WHERE id = " . $row['id'] . " ORDER BY name ASC");
            while ($item = $items->fetch()) {
                $pdowin->query("EXEC sp_salesorderrowimport
                    @salesordernumberid = ".$row['id'].",
                    @articleid = ".$item['artid'].",
                        ... // number of other params here
                    ");
            }
        }

        $pdowin->commit();
        echo "OK";
    } catch (PDOException $e) {
        $pdowin->rollback();
        echo "ERROR: ".$e;
    }

All queries work if I execute those separately. Thanks in advance.

Answer 1

You should prepare your statement:

$pdowin->beginTransaction();
    try {
        // headers
        $rows = $pdo->query("SELECT * FROM orders WHERE status = 2 AND productId IS NOT NULL GROUP BY id");

        $stmt = $pdowin->prepare("EXEC sp_salesorderimport
                @salesordernumberid = :saleId,
                    ... // number of other params here
                ");
        // fetch the rows
        while ($row = $rows->fetch(PDO::FETCH_ASSOC)) {
            $stmt->bindValue(':saleId',$row['id']);
            $stmt->execute();

It's not only for sql injection prevention, it avoid errors with quotes and escaping characters