存储过程无法在我的PHP代码中使用，但可以与SQL Client一起使用

Question

I'm working on a business monitor (a pannel that presents some metrics). To get that data I do a sql request. By the way, I used a stored procedure. My code is :

public function execErrorWarnLogs($id){
        try {
            $sql = "exec [BUSINESS_MONITOR_LOGS] @id='".$id."'";            
            $req = $this->_bdd->prepare($sql);
            $req->execute();
            $res =  $req->fetchAll(PDO::FETCH_ASSOC);
            $req->closeCursor();

            return $res;
        } catch (Exception $e) {
            echo $e->getMessage();
        }
    }

When I'm trying to get some data indexed by $id, I get some troubles. I got an array that has null values... However, if I execute that stored procedure with an SQL client I get results.

Is that already happened to someone here ? Can someone explain me why I get that ?

If you want more information, please let me know.

Thanks.

Answer 1

Is $id an integer or a string?

Try using bound parameter instead. This is a example how it is working perfectly in my code:

public function execErrorWarnLogs($id){
    try {
        $sql = "exec BUSINESS_MONITOR_LOGS @id=:id";            
        $req = $this->_bdd->prepare($sql);
        $req->execute([
             'id' => $id
        ]);
        $res =  $req->fetchAll(PDO::FETCH_ASSOC);
        $req->closeCursor();

        return $res;
    } catch (Exception $e) {
        echo $e->getMessage();
    }
}

You should use parameters for security reasons, too!

Two site notes:

---

If you do string interpolation you don't need to prepare the statement. Then you could just do:

$req = $this->_bdd->query($sql);
$res = $req->fetchAll(PDO::FETCH_ASSOC);

But the recommendet approach (for security) is to provide values as bound parameters and prepare the query.

---

As far as I know, you don't need $req->closeCursor() if you use Microsofts latest pdo driver for MSSQL. Whether you need closeCursor depends on the driver you use.

Answer 2

My stored procedure : CREATE PROCEDURE BUSINESS_MONITOR @id VARCHAR(50) AS
BEGIN

SET NOCOUNT ON;
SELECT e.METRIC_NAME, e.METRIC_VALUE
FROM MONITOR_EVENTS e
WHERE e.MAIN_ID = @id

END

Answer 3

There are two more possible reasons:

1. Encoding issue

I would assume, that you have an encoding issue. If $id contains chars, that are out of the ascii-range, and you have another encoding, this could cause the query to fail. So check the encoding of $id and of you db connection

2. Whitespaces in $id

Maybe you have whitespaces in you id.