SQL查询在phpMyAdmin中有效，但在使用PDO的php中无效

Question

I have a simple sql query that I would like to execute using PDO like so:

try {
    //connect to server
    $dbh = new PDO('mysql:host='.DBHOST.';dbname='.DBNAME, DBUSER, DBPASS);
    //check if username is valid
    $q="SELECT COUNT(*), first FROM users WHERE email='".$_POST['email']."'";
    echo $q;
    $stmt=$dbh->prepare($q);
    $stmt->execute();
    $f=$stmt->fetch();
    echo $f[0];
    echo $f[1];
catch (PDOException $e) {
    echo "There was an internal error resetting your password.";
  die();
}

The output for echo $q is to following:

SELECT COUNT(*) first FROM users WHERE email='ahg44@cornell.edu'

When I copy and paste this into the SQL tab of phpmyadmin the query successfully returns the tuple I am looking for. However, it does not return anything in the php code.

Additionally, when I call: $stmt->debugDumpParams(); after the query, this is printed:

SQL: [64] SELECT COUNT(*), first FROM users WHERE email='ahg44@cornell.edu' Params: 0

At first I thought it was an error with the reading the POST variable so I hard coded:

$q="SELECT COUNT(*), first FROM users WHERE email='ahg44@cornell.edu'";

in place of the original query but this got me the same results.

Additionally, if I change the query to something simple like:

$q="SELECT COUNT(*), first FROM users

the code works fine.

The weird thing is the this query worked perfectly yesterday so I must have made a minor error while cleaning up my code today. I have a hunch the problem has something to do with escape characters but I've been searching online for a while and haven't found a solution. thanks!

Answer 1

Although the PHP you pasted in your question looks correct, tt looks like you are actually missing a comma in the code that is executing..

This line:

SQL: [64] SELECT COUNT(*) first FROM users WHERE email='ahg44@cornell.edu' 

shows no comma after COUNT(*) , so first is becoming the alias for the COUNT(*) column, rather than being selected as a separate column.

Answer 2

You're using PDO incorrectly. You should be using prepared statements, like so:

$q = "SELECT COUNT(*), first FROM users WHERE email = ?";
$stmt = $dbh->prepare( $q);
$stmt->execute( array( $_POST['email']));
$f = $stmt->fetch();