By ekitel on

why use Database abstraction layer instead of regular php mysql functions?

I normally use mysql_result() with 3 paramaters, but db_result() only takes 2, so I have no idea how to specify the field I want from a row with the result of a 'SELECT *' query

⋅ Categories: Drupal 4.7.x

Comments

ekitel’s picture

ekitel commented

I see that it's a security issue, but I still don't see how I can use db_result without a 3rd parameter...

sepeck’s picture

sepeck commented

Not being a coder, does this page help?
http://drupal.org/node/62304

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide -|- Black Mountain

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide

nevets’s picture

nevets commented

I only use db_result if my sql statement only returns a single field, something like this

$count = db_result(db_query("SELECT COUNT(*) as count FROM {some_table}"));

If my query returns more than one field/column I do something like this

$results = db_query("SELECT * FROM {some_table}");
while ( $data = db_fetch_object($results) ) {
  $value1 = $results->field1;   // Field1 would be an actual field name in the table
}

The documentation for php notes the later case is quicker if dealing with multiple columns.

ekitel’s picture

ekitel commented

thanks! like I said I'm used to using a third parameter to specify the column, but I might have to switch to this db_fetch_object method if it's really going to create a major security problem

phuc77’s picture

phuc77 commented

A little error in your code there nevets.
You're using $results instead of $data as the object

$value1 = $data->field1;  // Field1 would be an actual field name in the table'
pyutaros’s picture

pyutaros commented

Thanks! This provided part of the solution for a code snippet I was trying to write in this thread:

http://drupal.org/node/141458

Thanks again!
Drupal's so easy, even I could do it.
http://www.kfol.org/

dman’s picture

dman commented

Don't use SELECT * then.

SELECT {colname} instead and you'll only be retrieving the bit you want.

.dan.
How to troubleshoot Drupal | http://www.coders.co.nz/

.dan. is the New Zealand Drupal Developer working on Government Web Standards