Hi. I have a local installation of SQLite3 and PHP which runs a small in house PHP application so sql injection is not an issue.
I am able to execute the following:
if(isset($_GET['deletequote'])) {
$qno = $_GET['deletequote'];
echo $qno;?><br><?php // for testing
$db = new SQLite3('./fi_data.db') or die('Cannot delete quote. Unable to open database');
$delresult = $db->query("
DELETE FROM quotes
WHERE quote_id = '".$qno."'");
}
The code above works correctly. However, when I execute the following no data is returned:
if(isset($_GET['editquote'])) {
$qno = $_GET['editquote'];
echo $qno;?><br><?php // for testing
$db = new SQLite3('./fi_data.db') or die('Cannot edit quote. Unable to open database');
$results = $db->query("SELECT quote_to FROM quotes WHERE quote_id = '".$qno."'");
while ($row = $results->fetchArray()) {
var_dump($row);
}
I have also tried with a prepared statement which also does not return any data:
if(isset($_GET['editquote'])) {
$qno = $_GET['editquote'];
echo $qno;?><br><?php // for testing
$db = new SQLite3('./fi_data.db');
$stmt = $db->prepare('SELECT quote_to FROM quotes WHERE quote_id = :qn');
$stmt->bindValue(':qn',$qno);
$results = $stmt->execute();
while ($row = $results->fetchArray()) {
var_dump($row);
}
If I remove the WHERE part of the query and use only:
'SELECT quote_to FROM quotes'
then the expected data is returned.
Why is the first statement working but not the second one?
Can anyone spot where I've gone wrong?
Thanks in advance.