Call PostgreSQL function in PHP

Question

CREATE OR REPLACE FUNCTION adduser(fn character varying,ln character varying,cit character varying,i integer,id integer)
  RETURNS void AS
$BODY$
        BEGIN                
    update tabtow set fname=fn,lname=ln,city=cit,phnum=i where phnum=id;
    select * from tabtow;
        END;
$BODY$
  LANGUAGE plpgsql VOLATILE
  COST 100;
ALTER FUNCTION increment(integer)
  OWNER TO postgres;

This is my function, how can I call it in PHP?

I'm trying like this, but it isn't working:

$sql = "update tabtow set fname = '$_REQUEST[fn]', lname = '$_REQUEST[ln]', city = '$_REQUEST[ci]', phnum = $_REQUEST[phnum] where phnum = $_REQUEST[id1]";
$res = pg_query($sql);

Please learn about SQL injection. ?fn=';UPDATE%20users%20SET%20password='somethingIknow'-- — Ry-
– Ry- ♦, Commented Oct 12, 2012 at 13:49

Richard Huxton · Accepted Answer · 2012-10-12 15:15:55Z

3

Just call the function:

$sql = 'SELECT adduser($1,$2,$3,$4)';
$res = pg_prepare($dbconn, "my_query", $sql);
$res = pg_execute($dbconn, "my_query", array('a','b','c',1));

And like the commenters above say, don't build your queries by hand - use parameterised queries like above.

answered Oct 12, 2012 at 15:15

Richard Huxton

23.6k5 gold badges43 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Call PostgreSQL function in PHP

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related