NYCPHP Meetup

[Flavio daCosta]

On 11/05/2007 05:16 PM, Michael Southwell wrote:
/snip
> The docs say the prepared statement must be a
> single statement, and of course
> this is not. But why don't I get an exception here?

Your /prepare/d statement is a single statement.  You have bound
'red;DELETE FROM wines' to your parameter, there is no error, the
bind_param() returns TRUE.  There are no `names` where color =
'red;DELETE FROM wines'


> 
> ...
> $param = "red;DELETE FROM wines";
> try {
>   if ( ! $query = $demo -> prepare( 'SELECT name FROM wines WHERE color
> = ?' ) ) throw new Exception ( "can't select from wines: " . $demo ->
> error );
>   if ( ! $query -> bind_param( 's', $param ) ) throw new Exception (
> "can't bind parameter: " . $demo -> mysqli_error );
>   if ( ! $query -> execute() ) throw new Exception ( "can't execute
> query: " . $demo -> mysqli_error );
> ...
>