ZEND PHP 5 Certification STUDY GUIDE

Database Programming ” 157
For the remainder of this chapter, you’ll notice the use of try/catch statements
(described in Chapter 6, OOP Programming). This is not only a best practice,
but it is very useful in debugging. Note that the default error mode for PDO
is PDO::ERRMODE_SILENT, which means that it will not emit any warnings or error
messages. For the examples in this chapter, however, the error mode is set to
PDO::ERRMODE_EXECEPTION. This causes PDO to throw a PDOExecption when an error
occurs. This exception can be caught and displayed for debugging purposes. The
following illustrates this setup; assume that all code examples replace the comment.
try
{
$dsn = ’mysql:host=localhost;dbname=library’;
$dbh = new PDO($dsn, ’dbuser’, ’dbpass’);
$dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, TRUE);
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// All other database calls go here
}
catch (PDOException $e)
{
echo ’Failed: ’ . $e->getMessage();
}
Querying the Database With PDO
To retrieve a result set from a database using PDO, use the PDO::query() method.
To escape a value included in a query (e.g. from $_GET, $_POST, $_COOKIE, etc.) use
the PDO::quote() method. PDO will ensure that the string is quoted properly for the
database used.
Licensed to 482634 - Amber Barrow (itsadmin@deakin.edu.au)
i
Not all database drivers for PDO implement the PDO::quote() method. For this reason,
and for the best possible approach to security, it is best to use prepared statements
and bound parameters, described in the next section.
// Filter input from $_GET