Bug #8538

single quotes in prepared query cause syntax error

Details

Submitted	2006-08-22 21:57 UTC
From	astle at lexi dot net
Assigned	lsmith
Status	Closed
Package	MDB2
PHP Version	5.1.4
OS	irrelevant
Roadmaps	(Not assigned)

Comments

[2006-08-22 21:57 UTC] astle at lexi dot net

Description:
------------
Using the mysqli driver and the prepare/execute method of doing a query fails if the prepared query has single quotes in it.

Rewriting the query to parameterize the single-quoted constant allows the query to work as expected. It should not be required to parameterize a constant in a query.

Test script:
---------------
# Assuming a working connection in $db:

$sth = $db -> prepare("SELECT * FROM table WHERE column = 'value' AND othercolumn = ?");

Expected result:
----------------
A usable statement object in $sth

Actual result:
--------------
An error object indicating a "syntax error".