如何在此oci_parse语句中插入变量

Question

I'm creating PHP code for a web form that sends an automated email after submission, I want to add all the form inputs to an Oracle database.

How do add a variable into my oci_parse statement? for example, how do I pass my $name var into this statement?

I have tried researching the documentation as well as different code.

<?php


if (!empty($name) || !empty($studentemail) || !empty($programofstudy) || !empty($enrolledinanonlineprogram)) {

//    create new cnnection (Table name is "register" for sql database)

$db = oci_new_connect("someuser", "somepassword", "somehost");

   if (!$db) {
     echo "connection error check your server config";
   }
   else {
     echo "Connection sucessful";
   }

   $name = $_POST['name'];
   $studentemail = $_POST['studentemail'];
   $programofstudy = $_POST['programofstudy'];
   $enrolledinanonlineprogram = $_POST['enrolledinanonlineprogram'];
   $bodytext = $_POST['bodytext'];

$stid = oci_parse($db, 'SELECT * FROM register');

$stid = oci_parse($db, 'INSERT INTO register (column1) VALUES (12345)');

oci_execute($stid);

echo "we inserted 12345";

   }
?>

The code works and "12345" is inserted into a table in the database however I want to pass in a variable into the oci_parse statement, ​not the hardcoded value.

Answer 1

$stid = oci_parse($db, 'INSERT INTO register (column1) VALUES ('.$variable.')');

OR

$stid = oci_parse($db, "INSERT INTO register (column1) VALUES ($variable)");
//notice the double quotes

If an array or object

$stid = oci_parse($db, 'INSERT INTO register (column1) VALUES ('.json_encode($variable).')');

Answer 2

Be aware of SQL injection, do not append values "as is" to SQL code.

Just imagine a situation

$stid = oci_parse($db, 
  "UPDATE my_password_table SET password = '$user_input_password' WHERE login = '$user_input_login'");

When user put something like ' or 1 = 1 or '' = ' into $user_input_login field, it makes all passwords to be updated.

Do not trust ANY data you get from a user. Even if you know the user is not able to type that text in that field.

So, the less wrong way to add value into a query is to replace all single quotes into double

$stid = oci_parse($db, 
  'INSERT INTO register (email) VALUES (' 
     . str_replace("'", "''", $studentemail) . ' )');

But the right way to do that is use [oci_bind_by_name][1] function

First, you declare bind variables by adding : before the name. Next, you bind the variable to that names

$stid = oci_parse($db, 'INSERT INTO register (email) VALUES (:EMAIL)');
oci_bind_array_by_name($stid, 'EMAIL', $studentemail);
oci_execute($stid);

Note, no quotes required to put string variables.

Also, be careful: this function does not assign the value. It sets up a link between the php variable and name in the query. The value of the variable is taken when oci_execute is performed. That means if you update the variable after it was bound but before query executed, the new value will be applied

$stid = oci_parse($db, 'INSERT INTO register (email) VALUES (:EMAIL)');
$studentemal = 'ABC';
oci_bind_array_by_name($stid, 'EMAIL', $studentemail);
$studentemal = 'XYZ';
oci_execute($stid); // XYZ value is inserted