Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Prepared statements and floats

I am playing with my own implementation of Google maps and I want to do it properly through prepared statements and mysqli object (not mysql as stated in the linked example) Also, I added "own registration" so I am afraid of SQL Injection. But, how do I bind Float value to the prepared statement?

My table has (among others) FLOAT type columns:

CREATE TABLE `markers` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`name` VARCHAR( 60 ) NOT NULL ,
`description` TEXT NOT NULL ,
`lat` FLOAT( 10, 6 ) NOT NULL ,
`lng` FLOAT( 10, 6 ) NOT NULL ,  
) ENGINE = MYISAM ;

But reading the manual I can see only these types:

Character   Description
i   corresponding variable has type integer
d   corresponding variable has type double
s   corresponding variable has type string
b   corresponding variable is a blob and will be sent in packets

Should I assume that when column is a FLOAT i should use b for a blob? (because its not string and not a double value). And the same for TEXT type column?

like image 625
Pavel Janicek Avatar asked Jan 28 '14 10:01

Pavel Janicek


People also ask

What are prepared statements used for?

A prepared statement is a feature used to execute the same (or similar) SQL statements repeatedly with high efficiency. Prepared statements basically work like this: Prepare: An SQL statement template is created and sent to the database.

What is mysqli_ bind_ param() function in PHP?

Description. bool mysqli_bind_param ( object stmt, array types, mixed var1 [, mixed var2, ...]) mysql_bind_param() is used to bind variables for the parameter markers in the SQL statement that was passed to mysql_prepare(). The array types specifies the types for the diffrent bind variables.

What is blind Param?

bindParam is a PHP inbuilt function used to bind a parameter to the specified variable name in a sql statement for access the database record. bindValue, on the other hand, is again a PHP inbuilt function used to bind the value of parameter to the specified variable name in sql statement. 2.


1 Answers

Just use "d" for non integer numbers

like image 59
gyss Avatar answered Oct 06 '22 20:10

gyss