View Single Post
Old 12-07-2012, 08:21 PM   PM User | #24
Fou-Lu
God Emperor


 
Fou-Lu's Avatar
 
Join Date: Sep 2002
Location: Saskatoon, Saskatchewan
Posts: 15,650
Thanks: 4
Thanked 2,451 Times in 2,420 Posts
Fou-Lu is a name known to allFou-Lu is a name known to allFou-Lu is a name known to allFou-Lu is a name known to allFou-Lu is a name known to allFou-Lu is a name known to all
Of course not, that's for use with mysql which requires an open connection to a mysql server. It won't work for SQLServer as they have different rules on escaping.
I'd recommend you bind. I guess you can probably force the data via hex or binary though as an alternative, but I'd suggest not reinventing the wheel with it. The prepared statements can accept a bind, and the sqlsrv_query itself can also accept an array to bind.
See the first example here for an example of the bind: http://ca2.php.net/manual/en/function.sqlsrv-query.php you simply replace the data with the ? for a placeholder, then provide it as an array for the third parameter to the sqlsrv_query method.

As for this error, streetID is not a valid input name. It appears you will have an id method that is hidden, but it must be rearranged on the form to appear before the form submit. You also won't need to redeclare it for the delete, as long as its a part of the same form the delete will be able to access the same information when submitted. For the deletion though, it may be a better idea to force an "Are you sure you want to delete. . ." message, then when they submit that one send it off to another request with like doDelete or something for its values.
Fou-Lu is offline   Reply With Quote