oci_bind_by_name and to_date PHP/OCI/Oracle

Question

I have the following:

    $ARTIFACT_NAME = $_POST['ArtifactName'];
    $ARTIFACT_TYPE = $_POST['ArtifactType'];
    $ARTIFACT_LOCATION = $_POST['ArtifactLocation'];
    $ARTIFACT_DOMAIN = $_POST['ArtifactDomain'];
    $ARTIFACT_AUTHOR = $_POST['ArtifactAuthor'];
    $ARTIFACT_LABEL = 'DB_'.$ARTIFACT_LOCATION.'_'.$ARTIFACT_DOMAIN.'_'.$ARTIFACT_NAME;
    $AUDIT_CONSTRAINTS = $_POST['AuditConstraints'];
    $SECURITY_CONSTRAINTS = $_POST['SecurityConstraints'];
    $REGISTERED_EMAIL = $_SERVER['HTTP_REMOTE_USER'];
    $REGISTERED_TIMESTAMP = "to_date('15-08-2011 14:32:37', 'DD-MM-YYYY HH24:MI:SS')";

    $query =    "INSERT INTO ".$db_schema.".ARTIFACTS (ARTIFACT_ID, ARTIFACT_NAME, ARTIFACT_TYPE, ARTIFACT_LOCATION, ARTIFACT_DOMAIN, ARTIFACT_AUTHOR, ARTIFACT_LABEL, AUDIT_CONSTRAINTS, SECURITY_CONSTRAINTS, REGISTERED_EMAIL, REGISTERED_TIMESTAMP)
                VALUES (:bind1, :bind2, :bind3, :bind4, :bind5, :bind6, :bind7, :bind8, :bind9, :bind10, :bind11)";
    $statement = oci_parse($connection, $query);

    oci_bind_by_name($statement, ":bind1", $ARTIFACT_ID);
    oci_bind_by_name($statement, ":bind2", $ARTIFACT_NAME);
    oci_bind_by_name($statement, ":bind3", $ARTIFACT_TYPE);
    oci_bind_by_name($statement, ":bind4", $ARTIFACT_LOCATION);
    oci_bind_by_name($statement, ":bind5", $ARTIFACT_DOMAIN);
    oci_bind_by_name($statement, ":bind6", $ARTIFACT_AUTHOR);
    oci_bind_by_name($statement, ":bind7", $ARTIFACT_LABEL);
    oci_bind_by_name($statement, ":bind8", $AUDIT_CONSTRAINTS);
    oci_bind_by_name($statement, ":bind9", $SECURITY_CONSTRAINTS);
    oci_bind_by_name($statement, ":bind10", $REGISTERED_EMAIL);
    oci_bind_by_name($statement, ":bind11", $REGISTERED_TIMESTAMP);

Which gives the following error:

ORA-01858: a non-numeric character was found where a numeric was expected

However, if i just don't bind $REGISTERED_TIMESTAMP and insert the to_date into the $query directly - it works perfectly.

What's going on?! This is drving me mad!

Answer 1

You're using an Oracle statement with bound parameters. That's good because it prevents SQL injections where dangerous code is inserted into your SQL statement. However, in this case, it prevents the TO_CHAR function from being executed. Instead, it tries to convert the whole string into a timestamp, which of course doesnt' work.

The solution is rather straight-forward: move to TO_CHAR function away from the bound parameter directly into the statement:

$REGISTERED_TIMESTAMP = "15-08-2011 14:32:37";

$query =    "INSERT INTO ".$db_schema.".ARTIFACTS (ARTIFACT_ID, ARTIFACT_NAME, ARTIFACT_TYPE, ARTIFACT_LOCATION, ARTIFACT_DOMAIN, ARTIFACT_AUTHOR, ARTIFACT_LABEL, AUDIT_CONSTRAINTS, SECURITY_CONSTRAINTS, REGISTERED_EMAIL, REGISTERED_TIMESTAMP)
            VALUES (:bind1, :bind2, :bind3, :bind4, :bind5, :bind6, :bind7, :bind8,
               :bind9, :bind10, to_date(:bind11, 'DD-MM-YYYY HH24:MI:SS'))";