<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Using MySQL Prepared Statements in PHP</title>
	<atom:link href="http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/</link>
	<description>Web development blog</description>
	<lastBuildDate>Tue, 07 Feb 2012 10:03:43 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: WildOne</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1932</link>
		<dc:creator>WildOne</dc:creator>
		<pubDate>Fri, 06 Jan 2012 02:12:38 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1932</guid>
		<description>Awesome article!

I do have one question though if I may. I&#039;m in the processing of porting over all my code into MySQLi prepared statements mainly for it&#039;s security abilities but I&#039;ve ran into a snag when trying to display multiple results on one page.

============= CODE =============
&lt;?php

//Display numbers 1 - 20;

echo &quot;&quot;;
	if($stmt-&gt;num_rows == NULL){
		echo &quot;No results found.&quot;;
	}else{
		while($stmt-&gt;fetch()){
		
    		echo &quot;&quot;.$numbers.&quot;&quot;; 
		}
		
	}
echo &quot;&quot;;

?&gt;
======== END CODE ============

Now, the above code works to display dynamic data stored in the db, but if I were to place another block of code, either the exact same fetch request or one requesting data from another table, both joined and not joined, under the first block of code, the results do not get displayed. 

Why is this? I can do it using regular MySQL methods but not when using prepared statements.

Also, I&#039;ve tried both keeping the stmt closed and open for testing purposes in each request block but still no luck.</description>
		<content:encoded><![CDATA[<p>Awesome article!</p>
<p>I do have one question though if I may. I&#8217;m in the processing of porting over all my code into MySQLi prepared statements mainly for it&#8217;s security abilities but I&#8217;ve ran into a snag when trying to display multiple results on one page.</p>
<p>============= CODE =============<br />
&lt;?php</p>
<p>//Display numbers 1 &#8211; 20;</p>
<p>echo &quot;&#8221;;<br />
	if($stmt-&gt;num_rows == NULL){<br />
		echo &#8220;No results found.&#8221;;<br />
	}else{<br />
		while($stmt-&gt;fetch()){</p>
<p>    		echo &#8220;&#8221;.$numbers.&#8221;";<br />
		}</p>
<p>	}<br />
echo &#8220;&#8221;;</p>
<p>?&gt;<br />
======== END CODE ============</p>
<p>Now, the above code works to display dynamic data stored in the db, but if I were to place another block of code, either the exact same fetch request or one requesting data from another table, both joined and not joined, under the first block of code, the results do not get displayed. </p>
<p>Why is this? I can do it using regular MySQL methods but not when using prepared statements.</p>
<p>Also, I&#8217;ve tried both keeping the stmt closed and open for testing purposes in each request block but still no luck.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: blendergasket</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1929</link>
		<dc:creator>blendergasket</dc:creator>
		<pubDate>Tue, 13 Dec 2011 20:46:27 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1929</guid>
		<description>Thanks for this! It was really concise and gave me exactly what I needed.</description>
		<content:encoded><![CDATA[<p>Thanks for this! It was really concise and gave me exactly what I needed.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Bob</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1923</link>
		<dc:creator>Bob</dc:creator>
		<pubDate>Fri, 25 Nov 2011 09:22:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1923</guid>
		<description>Hi
Great article and very useful but i&#039;m struggling with an update query.
A form on the web page allows user to input gifts into a textarea.
This is then used by getting 
$gifts = $_POST[&#039;gifts&#039;];
and then the db is UPDATED with the new values of $gifts .
This is then retrieved and displayed using nl2br to format it.

How do I use a statement in this instance, the problem i seem to have is using the posted value inside the statement. 
(also, I use a seperate file with the db connection in and include it when needed so there are no db connection details in the pages code)

thanks
Bob</description>
		<content:encoded><![CDATA[<p>Hi<br />
Great article and very useful but i&#8217;m struggling with an update query.<br />
A form on the web page allows user to input gifts into a textarea.<br />
This is then used by getting<br />
$gifts = $_POST['gifts'];<br />
and then the db is UPDATED with the new values of $gifts .<br />
This is then retrieved and displayed using nl2br to format it.</p>
<p>How do I use a statement in this instance, the problem i seem to have is using the posted value inside the statement.<br />
(also, I use a seperate file with the db connection in and include it when needed so there are no db connection details in the pages code)</p>
<p>thanks<br />
Bob</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anonymous</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1922</link>
		<dc:creator>Anonymous</dc:creator>
		<pubDate>Thu, 24 Nov 2011 18:19:18 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1922</guid>
		<description>[...]  [...]</description>
		<content:encoded><![CDATA[<p>[...]  [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Scott Seong</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1916</link>
		<dc:creator>Scott Seong</dc:creator>
		<pubDate>Mon, 14 Nov 2011 16:18:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1916</guid>
		<description>We have a custom built ecommerce website running McAfee Secure, and it detected SQL Injection vulnerability. I&#039;m replacing mysql statements with prepared statements with help of this tutorial.  Thanks.</description>
		<content:encoded><![CDATA[<p>We have a custom built ecommerce website running McAfee Secure, and it detected SQL Injection vulnerability. I&#8217;m replacing mysql statements with prepared statements with help of this tutorial.  Thanks.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steve</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1854</link>
		<dc:creator>Steve</dc:creator>
		<pubDate>Wed, 10 Aug 2011 17:41:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1854</guid>
		<description>All the functions used here have procedural equivalents, so there&#039;s no need to use OO code at all. Just look at the manual page for each function for the procedural alias an example using it.</description>
		<content:encoded><![CDATA[<p>All the functions used here have procedural equivalents, so there&#8217;s no need to use OO code at all. Just look at the manual page for each function for the procedural alias an example using it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Timothy Ryan</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1853</link>
		<dc:creator>Timothy Ryan</dc:creator>
		<pubDate>Wed, 10 Aug 2011 04:56:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1853</guid>
		<description>Thanks so much, I&#039;ve been all around google for days and I&#039;ve finally found an easy straightforward tutorial on how to secure sql transactions, every other tutorial expects for you to know OO PHP. Im new to OO PHP, and I was wondering if I could still use procedural PHP to echo stuff and make if statements to further process the retrieved sql data that has been binded into variables from your example. if not, does this mean that I have to go OO PHP all the way?</description>
		<content:encoded><![CDATA[<p>Thanks so much, I&#8217;ve been all around google for days and I&#8217;ve finally found an easy straightforward tutorial on how to secure sql transactions, every other tutorial expects for you to know OO PHP. Im new to OO PHP, and I was wondering if I could still use procedural PHP to echo stuff and make if statements to further process the retrieved sql data that has been binded into variables from your example. if not, does this mean that I have to go OO PHP all the way?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steve</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1804</link>
		<dc:creator>Steve</dc:creator>
		<pubDate>Mon, 06 Jun 2011 18:53:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1804</guid>
		<description>I edited the post for clarity. Thanks for the feedback.</description>
		<content:encoded><![CDATA[<p>I edited the post for clarity. Thanks for the feedback.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mike</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1803</link>
		<dc:creator>Mike</dc:creator>
		<pubDate>Mon, 06 Jun 2011 14:27:49 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1803</guid>
		<description>OK, checking dev.mysql.com it says that prepared statements are limited to data manipulation (INSERT, REPLACE, UPDATE, and DELETE), CREATE TABLE, and SELECT queries. Please update the article to include CREATE TABLE and SELECT as well so that people are not mislead.</description>
		<content:encoded><![CDATA[<p>OK, checking dev.mysql.com it says that prepared statements are limited to data manipulation (INSERT, REPLACE, UPDATE, and DELETE), CREATE TABLE, and SELECT queries. Please update the article to include CREATE TABLE and SELECT as well so that people are not mislead.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mike</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1802</link>
		<dc:creator>Mike</dc:creator>
		<pubDate>Mon, 06 Jun 2011 03:25:33 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1802</guid>
		<description>&quot;Does not work for ALL queries (only data manipulation queries)&quot;

SELECT is not a &quot;data manipulation&quot; query since the data is not changing. Maybe you could give some examples of what you mean by this statement since I&#039;m sure you will confuse people with it.</description>
		<content:encoded><![CDATA[<p>&#8220;Does not work for ALL queries (only data manipulation queries)&#8221;</p>
<p>SELECT is not a &#8220;data manipulation&#8221; query since the data is not changing. Maybe you could give some examples of what you mean by this statement since I&#8217;m sure you will confuse people with it.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

