Geek Answers Handbook

Oci_bind_by_name and to_date PHP / OCI / Oracle

I have the following:

    $ARTIFACT_NAME = $_POST['ArtifactName'];
    $ARTIFACT_TYPE = $_POST['ArtifactType'];
    $ARTIFACT_LOCATION = $_POST['ArtifactLocation'];
    $ARTIFACT_DOMAIN = $_POST['ArtifactDomain'];
    $ARTIFACT_AUTHOR = $_POST['ArtifactAuthor'];
    $ARTIFACT_LABEL = 'DB_'.$ARTIFACT_LOCATION.'_'.$ARTIFACT_DOMAIN.'_'.$ARTIFACT_NAME;
    $AUDIT_CONSTRAINTS = $_POST['AuditConstraints'];
    $SECURITY_CONSTRAINTS = $_POST['SecurityConstraints'];
    $REGISTERED_EMAIL = $_SERVER['HTTP_REMOTE_USER'];
    $REGISTERED_TIMESTAMP = "to_date('15-08-2011 14:32:37', 'DD-MM-YYYY HH24:MI:SS')";

    $query =    "INSERT INTO ".$db_schema.".ARTIFACTS (ARTIFACT_ID, ARTIFACT_NAME, ARTIFACT_TYPE, ARTIFACT_LOCATION, ARTIFACT_DOMAIN, ARTIFACT_AUTHOR, ARTIFACT_LABEL, AUDIT_CONSTRAINTS, SECURITY_CONSTRAINTS, REGISTERED_EMAIL, REGISTERED_TIMESTAMP)
                VALUES (:bind1, :bind2, :bind3, :bind4, :bind5, :bind6, :bind7, :bind8, :bind9, :bind10, :bind11)";
    $statement = oci_parse($connection, $query);

    oci_bind_by_name($statement, ":bind1", $ARTIFACT_ID);
    oci_bind_by_name($statement, ":bind2", $ARTIFACT_NAME);
    oci_bind_by_name($statement, ":bind3", $ARTIFACT_TYPE);
    oci_bind_by_name($statement, ":bind4", $ARTIFACT_LOCATION);
    oci_bind_by_name($statement, ":bind5", $ARTIFACT_DOMAIN);
    oci_bind_by_name($statement, ":bind6", $ARTIFACT_AUTHOR);
    oci_bind_by_name($statement, ":bind7", $ARTIFACT_LABEL);
    oci_bind_by_name($statement, ":bind8", $AUDIT_CONSTRAINTS);
    oci_bind_by_name($statement, ":bind9", $SECURITY_CONSTRAINTS);
    oci_bind_by_name($statement, ":bind10", $REGISTERED_EMAIL);
    oci_bind_by_name($statement, ":bind11", $REGISTERED_TIMESTAMP);

Which gives the following error:

ORA-01858: a non-numeric character was found where a numeric was expected

However, if I just don’t bind $REGISTERED_TIMESTAMPand paste to_datein $querydirectly - it works fine.

What's happening?! It annoys me!

+5
source share
1 answer

An Oracle statement with associated parameters is used. This is good because it prevents SQL injections into which dangerous code is inserted into your SQL statement. However, in this case, it prevents the execution of the function TO_CHAR. Instead, he tries to convert the entire string to a timestamp, which of course does not work.

: TO_CHAR :

$REGISTERED_TIMESTAMP = "15-08-2011 14:32:37";

$query =    "INSERT INTO ".$db_schema.".ARTIFACTS (ARTIFACT_ID, ARTIFACT_NAME, ARTIFACT_TYPE, ARTIFACT_LOCATION, ARTIFACT_DOMAIN, ARTIFACT_AUTHOR, ARTIFACT_LABEL, AUDIT_CONSTRAINTS, SECURITY_CONSTRAINTS, REGISTERED_EMAIL, REGISTERED_TIMESTAMP)
            VALUES (:bind1, :bind2, :bind3, :bind4, :bind5, :bind6, :bind7, :bind8,
               :bind9, :bind10, to_date(:bind11, 'DD-MM-YYYY HH24:MI:SS'))";
+8

More articles:


All Articles