session - php prepared statement inserting with trim or date() etc. php strict standards error -
hopefully easy question, haven't been able find answer. i'm learning use prepared statements rather mysqli_escape. have code:
$stmt = $dbc->prepare("select the_table email=? "); $stmt->bind_param("s", strtolower(trim($_request['email']))); i error message "php strict standards: variables should passed reference in".
am correct in thinking you're not supposed use strtolower / trim etc in bind param line? important? less secure first have separate:
$email = strtolower(trim($_request['email']))); i kind of thought should try , keep $_post, $_request bits in bind_param line.
i same issue in page with:
$stmt->bind_param("s", date("y-m-d") ); lastly , separately, safe use insert $_session variable directly? these have been set previously, can hacked? if i've set $_session['admin']="off" earlier, , later use in query admin=? bind_param says ("s", $_session['admin']); safe?
many thanks.
when trim($x), comes out not variable, reference value. bind_param method expects variable work. so, means need formatting , other calls before pass function. yes, thinking correct.
for example correct way it:
$date = date('y-m-d'); $stmt->bind_param("s", $date); i recommend read on references better understanding: http://php.net/manual/en/language.references.php
Comments
Post a Comment