Avoiding passing undefined variables to mysqli_stmt_bind_param?
0
Unfortunately, mysqli_stmt_bind_param doesn't prompt an error when an undefined variable is passed to the function (even with all errors enabled). So you could actually write something like this without getting so much as a warning (it just treats the undefined variable as NULL):
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
mysqli_report(MYSQLI_REPORT_ALL);
$db = mysqli_connect('host', 'user', 'pass', 'database');
$Stmt = mysqli_stmt_init($db);
mysqli_stmt_prepare($Stmt, 'SELECT id FROM table WHERE value = ?');
mysqli_stmt_bind_param($Stmt, 's', $UndefinedVariable); // <---------
mysqli_stmt_execute($Stmt);
mysqli_stmt_bind_result($Stmt, $ID);
mysqli_stmt_fetch($Stmt);
mysqli_stmt_close($Stmt);
?>
Now, I'm positive I already reported this to the PHP developers about a year ago, but I was basically told that they can't/won't fix it. However, I'm unable to find the report now...
So I'm hoping to find a solution to just get PHP to yell at me when I (probably) just made a typo in the source, which occasionally does happen! Is there a native solution to this?
php mysqli
asked Jan 3 at 17:05
user966939user966939
496221
|
show 4 more comments
0
Unfortunately, mysqli_stmt_bind_param doesn't prompt an error when an undefined variable is passed to the function (even with all errors enabled). So you could actually write something like this without getting so much as a warning (it just treats the undefined variable as NULL):
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
mysqli_report(MYSQLI_REPORT_ALL);
$db = mysqli_connect('host', 'user', 'pass', 'database');
$Stmt = mysqli_stmt_init($db);
mysqli_stmt_prepare($Stmt, 'SELECT id FROM table WHERE value = ?');
mysqli_stmt_bind_param($Stmt, 's', $UndefinedVariable); // <---------
mysqli_stmt_execute($Stmt);
mysqli_stmt_bind_result($Stmt, $ID);
mysqli_stmt_fetch($Stmt);
mysqli_stmt_close($Stmt);
?>
Now, I'm positive I already reported this to the PHP developers about a year ago, but I was basically told that they can't/won't fix it. However, I'm unable to find the report now...
So I'm hoping to find a solution to just get PHP to yell at me when I (probably) just made a typo in the source, which occasionally does happen! Is there a native solution to this?
php mysqli
asked Jan 3 at 17:05
user966939user966939
496221
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that$UndefinedVariableis not used. A static analysis tool like PHPStan will do the same.
– Alex Howansky
Jan 3 at 17:17
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter tomysqli_stmt_bind_paramis passed by reference. If you switch to PDO, you can usebindValue()instead ofbindParam()-- this will throw an E_NOTICE as expected.
– Alex Howansky
Jan 3 at 17:25
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
You could write a simple wrapper function likealternate_mysqli_stmt_bind_param()that just does anisset()check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.
– Alex Howansky
Jan 3 at 17:54
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that usesmysqli_error($db), only for the querying function.
– Funk Forty Niner
Jan 3 at 17:58
|
show 4 more comments
0
0
0
Unfortunately, mysqli_stmt_bind_param doesn't prompt an error when an undefined variable is passed to the function (even with all errors enabled). So you could actually write something like this without getting so much as a warning (it just treats the undefined variable as NULL):
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
mysqli_report(MYSQLI_REPORT_ALL);
$db = mysqli_connect('host', 'user', 'pass', 'database');
$Stmt = mysqli_stmt_init($db);
mysqli_stmt_prepare($Stmt, 'SELECT id FROM table WHERE value = ?');
mysqli_stmt_bind_param($Stmt, 's', $UndefinedVariable); // <---------
mysqli_stmt_execute($Stmt);
mysqli_stmt_bind_result($Stmt, $ID);
mysqli_stmt_fetch($Stmt);
mysqli_stmt_close($Stmt);
?>
Now, I'm positive I already reported this to the PHP developers about a year ago, but I was basically told that they can't/won't fix it. However, I'm unable to find the report now...
So I'm hoping to find a solution to just get PHP to yell at me when I (probably) just made a typo in the source, which occasionally does happen! Is there a native solution to this?
php mysqli
asked Jan 3 at 17:05
user966939user966939
496221
Unfortunately, mysqli_stmt_bind_param doesn't prompt an error when an undefined variable is passed to the function (even with all errors enabled). So you could actually write something like this without getting so much as a warning (it just treats the undefined variable as NULL):
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
mysqli_report(MYSQLI_REPORT_ALL);
$db = mysqli_connect('host', 'user', 'pass', 'database');
$Stmt = mysqli_stmt_init($db);
mysqli_stmt_prepare($Stmt, 'SELECT id FROM table WHERE value = ?');
mysqli_stmt_bind_param($Stmt, 's', $UndefinedVariable); // <---------
mysqli_stmt_execute($Stmt);
mysqli_stmt_bind_result($Stmt, $ID);
mysqli_stmt_fetch($Stmt);
mysqli_stmt_close($Stmt);
?>
Now, I'm positive I already reported this to the PHP developers about a year ago, but I was basically told that they can't/won't fix it. However, I'm unable to find the report now...
So I'm hoping to find a solution to just get PHP to yell at me when I (probably) just made a typo in the source, which occasionally does happen! Is there a native solution to this?
php mysqli
php mysqli
asked Jan 3 at 17:05
user966939user966939
496221
asked Jan 3 at 17:05
user966939user966939
496221
edited Jan 3 at 18:21
user966939
asked Jan 3 at 17:05
user966939user966939
496221
asked Jan 3 at 17:05
user966939user966939
496221
asked Jan 3 at 17:05
user966939user966939
496221
496221
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that$UndefinedVariableis not used. A static analysis tool like PHPStan will do the same.
– Alex Howansky
Jan 3 at 17:17
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter tomysqli_stmt_bind_paramis passed by reference. If you switch to PDO, you can usebindValue()instead ofbindParam()-- this will throw an E_NOTICE as expected.
– Alex Howansky
Jan 3 at 17:25
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
You could write a simple wrapper function likealternate_mysqli_stmt_bind_param()that just does anisset()check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.
– Alex Howansky
Jan 3 at 17:54
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that usesmysqli_error($db), only for the querying function.
– Funk Forty Niner
Jan 3 at 17:58
|
show 4 more comments
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that$UndefinedVariableis not used. A static analysis tool like PHPStan will do the same.
– Alex Howansky
Jan 3 at 17:17
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter tomysqli_stmt_bind_paramis passed by reference. If you switch to PDO, you can usebindValue()instead ofbindParam()-- this will throw an E_NOTICE as expected.
– Alex Howansky
Jan 3 at 17:25
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
You could write a simple wrapper function likealternate_mysqli_stmt_bind_param()that just does anisset()check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.
– Alex Howansky
Jan 3 at 17:54
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that usesmysqli_error($db), only for the querying function.
– Funk Forty Niner
Jan 3 at 17:58
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that
$UndefinedVariable is not used. A static analysis tool like PHPStan will do the same.– Alex Howansky
Jan 3 at 17:17
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that
$UndefinedVariable is not used. A static analysis tool like PHPStan will do the same.– Alex Howansky
Jan 3 at 17:17
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter to
mysqli_stmt_bind_param is passed by reference. If you switch to PDO, you can use bindValue() instead of bindParam() -- this will throw an E_NOTICE as expected.– Alex Howansky
Jan 3 at 17:25
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter to
mysqli_stmt_bind_param is passed by reference. If you switch to PDO, you can use bindValue() instead of bindParam() -- this will throw an E_NOTICE as expected.– Alex Howansky
Jan 3 at 17:25
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
You could write a simple wrapper function like
alternate_mysqli_stmt_bind_param() that just does an isset() check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.– Alex Howansky
Jan 3 at 17:54
You could write a simple wrapper function like
alternate_mysqli_stmt_bind_param() that just does an isset() check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.– Alex Howansky
Jan 3 at 17:54
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that uses
mysqli_error($db), only for the querying function.– Funk Forty Niner
Jan 3 at 17:58
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that uses
mysqli_error($db), only for the querying function.– Funk Forty Niner
Jan 3 at 17:58
|
show 4 more comments
2 Answers
2
active
oldest
votes
0
The only native solution that doesn't involve code is to look through your error log for undefined variable notices.
As for a native solution involving code, do some basic input validation, e.g. using isset($variable). For example, you could do the following:
if(!isset($UndefinedVariable)) {
throw new Exception('Expected variabled "$UndefinedVariable" to be defined.');
}
In general you should really be doing input validation, anyway. It takes more time and makes your code longer, but it also ensures that your code is safer and does what you expect it to.
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" throughmysqli_stmt_bind_resultfor example? (i.e. result variables from a query?). As opposed to just your typical$Variable = 'Value';declarations.
– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
|
show 4 more comments
0
Using a wrapper seems to work, but I'm not sure if it's the best solution?
function db_stmt_bind_param($Stmt, $Types, ...$Params)
{
return mysqli_stmt_bind_param($Stmt, $Types, ...$Params);
}
Alternatively:
mysqli_stmt_bind_param($Stmt, $Types, ...[$Param1, $Param2, $Param3])
Both requires using splat operator, however, which is a relatively recent implementation.
answered Jan 3 at 17:56
user966939user966939
496221
add a comment |
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54026727%2favoiding-passing-undefined-variables-to-mysqli-stmt-bind-param%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
The only native solution that doesn't involve code is to look through your error log for undefined variable notices.
As for a native solution involving code, do some basic input validation, e.g. using isset($variable). For example, you could do the following:
if(!isset($UndefinedVariable)) {
throw new Exception('Expected variabled "$UndefinedVariable" to be defined.');
}
In general you should really be doing input validation, anyway. It takes more time and makes your code longer, but it also ensures that your code is safer and does what you expect it to.
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" throughmysqli_stmt_bind_resultfor example? (i.e. result variables from a query?). As opposed to just your typical$Variable = 'Value';declarations.
– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
|
show 4 more comments
0
The only native solution that doesn't involve code is to look through your error log for undefined variable notices.
As for a native solution involving code, do some basic input validation, e.g. using isset($variable). For example, you could do the following:
if(!isset($UndefinedVariable)) {
throw new Exception('Expected variabled "$UndefinedVariable" to be defined.');
}
In general you should really be doing input validation, anyway. It takes more time and makes your code longer, but it also ensures that your code is safer and does what you expect it to.
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" throughmysqli_stmt_bind_resultfor example? (i.e. result variables from a query?). As opposed to just your typical$Variable = 'Value';declarations.
– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
|
show 4 more comments
0
0
0
The only native solution that doesn't involve code is to look through your error log for undefined variable notices.
As for a native solution involving code, do some basic input validation, e.g. using isset($variable). For example, you could do the following:
if(!isset($UndefinedVariable)) {
throw new Exception('Expected variabled "$UndefinedVariable" to be defined.');
}
In general you should really be doing input validation, anyway. It takes more time and makes your code longer, but it also ensures that your code is safer and does what you expect it to.
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
The only native solution that doesn't involve code is to look through your error log for undefined variable notices.
As for a native solution involving code, do some basic input validation, e.g. using isset($variable). For example, you could do the following:
if(!isset($UndefinedVariable)) {
throw new Exception('Expected variabled "$UndefinedVariable" to be defined.');
}
In general you should really be doing input validation, anyway. It takes more time and makes your code longer, but it also ensures that your code is safer and does what you expect it to.
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
answered Jan 3 at 17:16
B. FlemingB. Fleming
2,6721819
2,6721819
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" throughmysqli_stmt_bind_resultfor example? (i.e. result variables from a query?). As opposed to just your typical$Variable = 'Value';declarations.
– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
|
show 4 more comments
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" throughmysqli_stmt_bind_resultfor example? (i.e. result variables from a query?). As opposed to just your typical$Variable = 'Value';declarations.
– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
I do have input validation in place. But that doesn't prevent things like typos directly in the source. Unfortunately...
– user966939
Jan 3 at 17:37
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
If you're concerned about typos in your source code, it would be best for you to use a proper IDE and/or a linter, that way your undefined variables are detected by default. Some IDEs have static code analysis built in as a native feature as well. PHP's weak typing system is a feature, and your only way around it is to use data validation, appropriate tools like an IDE and a linter, and/or monitoring your error logs. There's no other way around it.
– B. Fleming
Jan 3 at 17:50
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
I came up with one possible solution actually (see answers), but it may not be the best way... what do you think?
– user966939
Jan 3 at 17:57
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" through
mysqli_stmt_bind_result for example? (i.e. result variables from a query?). As opposed to just your typical $Variable = 'Value'; declarations.– user966939
Jan 3 at 18:28
On the topic of proper IDEs -- are any of them actually able to detect when variables are "defined" through
mysqli_stmt_bind_result for example? (i.e. result variables from a query?). As opposed to just your typical $Variable = 'Value'; declarations.– user966939
Jan 3 at 18:28
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
Regarding your solution, I'm actually not sure how it helps. Don't you run into virtually the same problem, albeit passing a potentially undefined variable to a wrapper function instead of the native one? Granted it can be useful because you can e.g. validate your parameters in one place rather than potentially several.
– B. Fleming
Jan 3 at 20:44
|
show 4 more comments
0
Using a wrapper seems to work, but I'm not sure if it's the best solution?
function db_stmt_bind_param($Stmt, $Types, ...$Params)
{
return mysqli_stmt_bind_param($Stmt, $Types, ...$Params);
}
Alternatively:
mysqli_stmt_bind_param($Stmt, $Types, ...[$Param1, $Param2, $Param3])
Both requires using splat operator, however, which is a relatively recent implementation.
answered Jan 3 at 17:56
user966939user966939
496221
add a comment |
0
Using a wrapper seems to work, but I'm not sure if it's the best solution?
function db_stmt_bind_param($Stmt, $Types, ...$Params)
{
return mysqli_stmt_bind_param($Stmt, $Types, ...$Params);
}
Alternatively:
mysqli_stmt_bind_param($Stmt, $Types, ...[$Param1, $Param2, $Param3])
Both requires using splat operator, however, which is a relatively recent implementation.
answered Jan 3 at 17:56
user966939user966939
496221
add a comment |
0
0
0
Using a wrapper seems to work, but I'm not sure if it's the best solution?
function db_stmt_bind_param($Stmt, $Types, ...$Params)
{
return mysqli_stmt_bind_param($Stmt, $Types, ...$Params);
}
Alternatively:
mysqli_stmt_bind_param($Stmt, $Types, ...[$Param1, $Param2, $Param3])
Both requires using splat operator, however, which is a relatively recent implementation.
answered Jan 3 at 17:56
user966939user966939
496221
Using a wrapper seems to work, but I'm not sure if it's the best solution?
function db_stmt_bind_param($Stmt, $Types, ...$Params)
{
return mysqli_stmt_bind_param($Stmt, $Types, ...$Params);
}
Alternatively:
mysqli_stmt_bind_param($Stmt, $Types, ...[$Param1, $Param2, $Param3])
Both requires using splat operator, however, which is a relatively recent implementation.
answered Jan 3 at 17:56
user966939user966939
496221
edited Jan 3 at 20:03
answered Jan 3 at 17:56
user966939user966939
496221
answered Jan 3 at 17:56
user966939user966939
496221
answered Jan 3 at 17:56
user966939user966939
496221
496221
add a comment |
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54026727%2favoiding-passing-undefined-variables-to-mysqli-stmt-bind-param%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Odd that it doesn't raise an E_NOTICE. In any case, a good IDE will warn you that
$UndefinedVariableis not used. A static analysis tool like PHPStan will do the same.– Alex Howansky
Jan 3 at 17:17
Ah ok found it -- it doesn't raise an E_NOTICE because the 3rd parameter to
mysqli_stmt_bind_paramis passed by reference. If you switch to PDO, you can usebindValue()instead ofbindParam()-- this will throw an E_NOTICE as expected.– Alex Howansky
Jan 3 at 17:25
@AlexHowansky I have considered switching from mysqli purely for this little flaw. But I prefer procedural programming, and last I checked PDO only has an OOP interface. Do you have any tips for procedural programming? Maybe a library?
– user966939
Jan 3 at 17:42
You could write a simple wrapper function like
alternate_mysqli_stmt_bind_param()that just does anisset()check first, but I wouldn't waste run-time cycles on that since this is really a compile-time issue. I'd use PHPStan, it will find a ton of probable errors in your code that you didn't even know you had.– Alex Howansky
Jan 3 at 17:54
"mysqli_stmt_bind_param doesn't prompt an error (even with all errors enabled) in PHP" - That's because it isn't a function that uses
mysqli_error($db), only for the querying function.– Funk Forty Niner
Jan 3 at 17:58