How to Bind an OCI Function
The PHP language has built-in support for variable binding with the function “oci-bind-by-name.” Variable binding is important because it prevents injection attacks on websites and allows database statements to be reused. An injection attack occurs when an input field on a website is directly converted into a database query. This gives malicious users access to the database. Data binding solves this problem. By using the PHP function “oci-bind-by-name,” you can build secure websites that aren’t vulnerable to injection attacks.
Other People Are Reading
Instructions
-
-
1
Decide how you will run your PHP code. If you have a PHP server, you can execute code using PHP files. If you do not have access to a PHP server, you can use an online PHP interpreter. Enter the code in this tutorial into either a PHP file or the online PHP interpreter.
-
2
Begin your PHP program with the following statement:
<?php
-
-
3
Create a variable that stores a connection string to your database. This string is highly specific to your database. PHP uses the function “oci_connect” to connect to Oracle databases. The function takes several parameters: a username, a password and the connection string. The statement below is an example of how to use “oci_connect” with a sample connection string:
$connection = oci_connect(‘username’, ‘password’, ‘localhost/OCIDB’);
-
4
Create a variable that stores an OCI statement. An OCI statement consists of a connection string and a database query. A database query is a command that is issued to the database. For example, the following statement creates a table called “MyTable” that has two columns: an ID number and a text string, or VARCHAR:
$OCIStatement = oci_parse($connection, “INSERT INTO MyTable (id, text) VALUES(:id, :text)”);
-
5
Use the function “oci_bind_by_name” to insert the value “1” into the first row of the ID column:
oci_bind_by_name($OCIStatement, “:id”, 1);
-
6
Use the function “oci_bind_by_name” to insert the value “Text” into the first row of the text column:
oci_bind_by_name($OCIStatement, “:text”, “Text”);
-
7
Conclude your PHP program with the statement below. Your program is now ready to be tested on your PHP server or online PHP interpreter.
?>
-
1
References
Resources
- Photo Credit Comstock/Comstock/Getty Images
