fat free framework sql sanitization

Question

so i'm trying to learn f3 and the database syntax is eluding me.

looking at the docs it seems that you pass a string of your sql and array of values to replace. but i can't seem to get it working. i have tried just using one parameter, using arrays, not using arrays, etc, etc. eventually i will need to replace 5+ variables in a query so i really need to understand how it works. thanx in advance.

$db = new DB\SQL(
    $f3->get('db'), 
    $f3->get('dbuser'), 
    $f3->get('dbpass')
);
$x = $db->exec(
    "SELECT user_id, email, token FROM `user_primary` WHERE `first_name` = ':first' AND `last_name` = ':last';",
    array(
        ':first' => $f3->get('PARAMS.first'),
        ':last' => $f3->get('PARAMS.last')
    )
);
echo '<pre>'.print_r($x, true).'</pre>';

Answer 1

the error i was making is with the quotes.

select * from table where name = ':name'

is not correct. you need to remove the quotes

select * from table where name = :name

so if you want to use multiple just array nest them

$db->exec(
    `select * from table where first_name = :fname and last_name = :lname`,
    array(
        ':fname' => 'xero',
        ':lname' => 'harrison'
    )
);

maybe this will help someone else.