How do I convert a simple bit of MySQL to pdo

Question

I know nothing about MySQL let alone PDO and am struggling to convert something to PDO.

I have tried everything I can by copying code from other bits of the script but can't get anything to work and knowing absolutely nothing about MySQL let alone PDO does not help in fact MySQL seems a heck of a lot easier to say the least.

I want is this very simple bit of MySQL to work as PDO.

$query = " UPDATE " . $DBPrefix . "settings SET
logo = '" . $_FILES['logo']['name'] . "' ";
$system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
$system->SETTINGS['logo'] = $_FILES['logo']['name'];

Answer 1

First you need to create new PDO() object. Something like this:

$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
$opt = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
];
$pdo = new PDO($dsn, $user, $pass, $opt);

Next your code will transform to:

$sql = "UPDATE {$DBPrefix}settings SET logo = '{$_FILES['logo']['name']}'";
$result = $pdo->query($sql);

But this is not a good practice to just write SQL manually, wrapping and escaping all params. Better way using prepared statements, it'll wrap and escape all params automatically:

$ps = $pdo->prepare("UPDATE {$DBPrefix}settings SET logo = :logo");
$ps->execute(['logo' => $_FILES['logo']['name']]);

Answer 2

you should put . after db prefix:

$query = " UPDATE " . $DBPrefix . ".settings SET
logo = '" . $_FILES['logo']['name'] . "' ";
$system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
$system->SETTINGS['logo'] = $_FILES['logo']['name'];