Raw Insert Query With Prepared Statements

I have a helper library in app/Lib that needs to store a log so I'm trying DboSource::rawQuery(). Docs are pretty vague: /** * Executes given SQL statement. * * @param string $s

Solution 1:

Answer is (apparently): none.

In the source code for Sqlserver::_execute() we can read:

/**
 * Executes given SQL statement.
 *
 * @param string $sql SQL statement
 * @param array $params list of params to be bound to query (supported only inselect)
 * @param array $prepareOptions Options to be used in the prepare statement
 * @return mixed PDOStatement if query executes with no problem, trueas the result of a successful, falseonerror
 * query returning no rows, such as a CREATE statement, false otherwise
 * @throws PDOException
 */

So you can only use prepared statements on reading, not on writing :-!

You need to get back to the early 2000s and escape:

publicfunctionlog (DataSource $db) {
    $sql = sprintf('INSERT INTO log (foo, bar)
        VALUES (%s, %s)',
        $db->value('foo'),
        $db->value('bar')
    );
    $db->rawQuery($sql);
}