[RESOLVED] Parameterized queries using PHP & MSSQL

[Square1]

Hi all:

I am brand new at using PHP and am converting my ASP classic site over.

On my ASP site I use escapes for all my queries. Replace(INPUT,"'","''"). But as I am redoing everything I would like to now use Parameterized Queries as I suspect that is the safest way of all to do things.

1. My head is spinning from all the Googling I have done on this and still cannot find an example I can understand. Granted, I am not very accomplished as a developer.

2. Am I correct in my assumption that if I am redoing everything I should use Parameterized queries?

3. I have the php_mssql.dll file on php

If I give an example of a query, could someone show me how this would be written as a parameterized query?

Thank you!

[Square1]

Here is code I am trying out. I am getting an error message:

/* Specify the server and connection string attributes. */
$serverName = "XXXXXXX";

/* Get UID and PWD from application-specific files.  */
$uid = "XXXXXX";
$pwd = "XXXXXXX";
$connectionInfo = array( "UID"=>$uid,
                         "PWD"=>$pwd,
                         "Database"=>"XXXXXXXXX");

/* Connect using SQL Server Authentication. */
$conn = sqlsrv_connect( $serverName, $connectionInfo);//THIS IS LINE 24
if( $conn === false )
{
     echo "Unable to connect.</br>";
     die( print_r( sqlsrv_errors(), true));
}


$name = 'Hello';
$email = 'Goodbye';
$params = array($name, $email);
$sql = 'INSERT INTO Temp (Teams, Records) VALUES (?, ?)';

$stmt = sqlsrv_query($conn, $tsql, $params);
sqlsrv_free_stmt( $stmt);
sqlsrv_close( $conn);

I am getting the following error:

Fatal error: Call to undefined function sqlsrv_connect() in C:\Web\MySite\test.php on line 24

I installed the sqlsrv files in php/ext and I added extension=php_sqlsrv.dll to php.ini and then I rebooted.

Any help appreciated!

[Square1]

This has been solved. Thank you.