<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Using MySQL Prepared Statements in PHP</title>
	<atom:link href="http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/</link>
	<description>Web development blog</description>
	<lastBuildDate>Wed, 11 Apr 2012 03:57:31 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: Nichlas</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1964</link>
		<dc:creator>Nichlas</dc:creator>
		<pubDate>Wed, 04 Apr 2012 02:27:17 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1964</guid>
		<description>Trying to use &quot;LIKE&quot; with prepared statements but it only throws me an error whatever I try.
What&#039;s the exact syntax for use with wildcards and the LIKE statement?</description>
		<content:encoded><![CDATA[<p>Trying to use &#8220;LIKE&#8221; with prepared statements but it only throws me an error whatever I try.<br />
What&#8217;s the exact syntax for use with wildcards and the LIKE statement?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Accepting PayPal in games &#124; Paul&#039;s blog@Wildbunny</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1954</link>
		<dc:creator>Accepting PayPal in games &#124; Paul&#039;s blog@Wildbunny</dc:creator>
		<pubDate>Tue, 20 Mar 2012 11:26:19 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1954</guid>
		<description>[...] Mysql has this covered in the form of prepared statements which handle this problem for you. The disadvantage is they are quite cumbersome compared to the [...]</description>
		<content:encoded><![CDATA[<p>[...] Mysql has this covered in the form of prepared statements which handle this problem for you. The disadvantage is they are quite cumbersome compared to the [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: WildOne</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1932</link>
		<dc:creator>WildOne</dc:creator>
		<pubDate>Fri, 06 Jan 2012 02:12:38 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1932</guid>
		<description>Awesome article!

I do have one question though if I may. I&#039;m in the processing of porting over all my code into MySQLi prepared statements mainly for it&#039;s security abilities but I&#039;ve ran into a snag when trying to display multiple results on one page.

============= CODE =============
&lt;?php

//Display numbers 1 - 20;

echo &quot;&quot;;
	if($stmt-&gt;num_rows == NULL){
		echo &quot;No results found.&quot;;
	}else{
		while($stmt-&gt;fetch()){
		
    		echo &quot;&quot;.$numbers.&quot;&quot;; 
		}
		
	}
echo &quot;&quot;;

?&gt;
======== END CODE ============

Now, the above code works to display dynamic data stored in the db, but if I were to place another block of code, either the exact same fetch request or one requesting data from another table, both joined and not joined, under the first block of code, the results do not get displayed. 

Why is this? I can do it using regular MySQL methods but not when using prepared statements.

Also, I&#039;ve tried both keeping the stmt closed and open for testing purposes in each request block but still no luck.</description>
		<content:encoded><![CDATA[<p>Awesome article!</p>
<p>I do have one question though if I may. I&#8217;m in the processing of porting over all my code into MySQLi prepared statements mainly for it&#8217;s security abilities but I&#8217;ve ran into a snag when trying to display multiple results on one page.</p>
<p>============= CODE =============<br />
&lt;?php</p>
<p>//Display numbers 1 &#8211; 20;</p>
<p>echo &quot;&#8221;;<br />
	if($stmt-&gt;num_rows == NULL){<br />
		echo &#8220;No results found.&#8221;;<br />
	}else{<br />
		while($stmt-&gt;fetch()){</p>
<p>    		echo &#8220;&#8221;.$numbers.&#8221;";<br />
		}</p>
<p>	}<br />
echo &#8220;&#8221;;</p>
<p>?&gt;<br />
======== END CODE ============</p>
<p>Now, the above code works to display dynamic data stored in the db, but if I were to place another block of code, either the exact same fetch request or one requesting data from another table, both joined and not joined, under the first block of code, the results do not get displayed. </p>
<p>Why is this? I can do it using regular MySQL methods but not when using prepared statements.</p>
<p>Also, I&#8217;ve tried both keeping the stmt closed and open for testing purposes in each request block but still no luck.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: blendergasket</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1929</link>
		<dc:creator>blendergasket</dc:creator>
		<pubDate>Tue, 13 Dec 2011 20:46:27 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1929</guid>
		<description>Thanks for this! It was really concise and gave me exactly what I needed.</description>
		<content:encoded><![CDATA[<p>Thanks for this! It was really concise and gave me exactly what I needed.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Bob</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1923</link>
		<dc:creator>Bob</dc:creator>
		<pubDate>Fri, 25 Nov 2011 09:22:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1923</guid>
		<description>Hi
Great article and very useful but i&#039;m struggling with an update query.
A form on the web page allows user to input gifts into a textarea.
This is then used by getting 
$gifts = $_POST[&#039;gifts&#039;];
and then the db is UPDATED with the new values of $gifts .
This is then retrieved and displayed using nl2br to format it.

How do I use a statement in this instance, the problem i seem to have is using the posted value inside the statement. 
(also, I use a seperate file with the db connection in and include it when needed so there are no db connection details in the pages code)

thanks
Bob</description>
		<content:encoded><![CDATA[<p>Hi<br />
Great article and very useful but i&#8217;m struggling with an update query.<br />
A form on the web page allows user to input gifts into a textarea.<br />
This is then used by getting<br />
$gifts = $_POST['gifts'];<br />
and then the db is UPDATED with the new values of $gifts .<br />
This is then retrieved and displayed using nl2br to format it.</p>
<p>How do I use a statement in this instance, the problem i seem to have is using the posted value inside the statement.<br />
(also, I use a seperate file with the db connection in and include it when needed so there are no db connection details in the pages code)</p>
<p>thanks<br />
Bob</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anonymous</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1922</link>
		<dc:creator>Anonymous</dc:creator>
		<pubDate>Thu, 24 Nov 2011 18:19:18 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1922</guid>
		<description>[...]  [...]</description>
		<content:encoded><![CDATA[<p>[...]  [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Scott Seong</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1916</link>
		<dc:creator>Scott Seong</dc:creator>
		<pubDate>Mon, 14 Nov 2011 16:18:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1916</guid>
		<description>We have a custom built ecommerce website running McAfee Secure, and it detected SQL Injection vulnerability. I&#039;m replacing mysql statements with prepared statements with help of this tutorial.  Thanks.</description>
		<content:encoded><![CDATA[<p>We have a custom built ecommerce website running McAfee Secure, and it detected SQL Injection vulnerability. I&#8217;m replacing mysql statements with prepared statements with help of this tutorial.  Thanks.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steve</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1854</link>
		<dc:creator>Steve</dc:creator>
		<pubDate>Wed, 10 Aug 2011 17:41:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1854</guid>
		<description>All the functions used here have procedural equivalents, so there&#039;s no need to use OO code at all. Just look at the manual page for each function for the procedural alias an example using it.</description>
		<content:encoded><![CDATA[<p>All the functions used here have procedural equivalents, so there&#8217;s no need to use OO code at all. Just look at the manual page for each function for the procedural alias an example using it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Timothy Ryan</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1853</link>
		<dc:creator>Timothy Ryan</dc:creator>
		<pubDate>Wed, 10 Aug 2011 04:56:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1853</guid>
		<description>Thanks so much, I&#039;ve been all around google for days and I&#039;ve finally found an easy straightforward tutorial on how to secure sql transactions, every other tutorial expects for you to know OO PHP. Im new to OO PHP, and I was wondering if I could still use procedural PHP to echo stuff and make if statements to further process the retrieved sql data that has been binded into variables from your example. if not, does this mean that I have to go OO PHP all the way?</description>
		<content:encoded><![CDATA[<p>Thanks so much, I&#8217;ve been all around google for days and I&#8217;ve finally found an easy straightforward tutorial on how to secure sql transactions, every other tutorial expects for you to know OO PHP. Im new to OO PHP, and I was wondering if I could still use procedural PHP to echo stuff and make if statements to further process the retrieved sql data that has been binded into variables from your example. if not, does this mean that I have to go OO PHP all the way?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Steve</title>
		<link>http://www.ultramegatech.com/2009/07/using-mysql-prepared-statements-in-php/comment-page-1/#comment-1804</link>
		<dc:creator>Steve</dc:creator>
		<pubDate>Mon, 06 Jun 2011 18:53:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.ultramegatech.com/blog/?p=549#comment-1804</guid>
		<description>I edited the post for clarity. Thanks for the feedback.</description>
		<content:encoded><![CDATA[<p>I edited the post for clarity. Thanks for the feedback.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

