php - mysql 过程中游标循环后的 select 语句在 pdo 中没有输出，但在 phpmyadmin 中有输出

Question

我正在尝试在选择查询上运行包含游标循环的过程 之后是输出选择。但是我的“输出选择”在 pdo 调用上没有输出，而当我在 phpmyadmin 或工作台中调用我的过程时它有输出。 这是我的程序:

   CREATE DEFINER=`root`@`localhost` PROCEDURE `pr_test`(IN `_payment_id` BIGINT (20),IN `_saleId` BIGINT(20))

开始

DECLARE finished INTEGER DEFAULT 0;

DECLARE  cv_user_id VARCHAR(250) DEFAULT '';
DECLARE  output_id VARCHAR(250) DEFAULT '';

DECLARE `noStocks_Cursor` CURSOR 
    FOR 
        SELECT * FROM `noStocks_temp`; 

DECLARE exit handler for sqlexception
BEGIN
GET DIAGNOSTICS CONDITION 1
@p1 = RETURNED_SQLSTATE, @p2 = MESSAGE_TEXT;
SELECT @p1 AS RETURNED_SQLSTATE, @p2 AS MESSAGE_TEXT;
ROLLBACK;
END;

DECLARE exit handler for sqlwarning
BEGIN
GET DIAGNOSTICS CONDITION 1
@p1 = RETURNED_SQLSTATE, @p2 = MESSAGE_TEXT;
SELECT @p1 AS RETURNED_SQLSTATE, @p2 AS MESSAGE_TEXT;
ROLLBACK;
END;        

DECLARE CONTINUE HANDLER FOR NOT FOUND SET finished = 1;

START TRANSACTION;

    DROP TEMPORARY TABLE IF EXISTS `noStocks_temp`;
    CREATE TEMPORARY TABLE IF NOT EXISTS 
        `noStocks_temp` ENGINE=MEMORY  
        AS  
        (
            SELECT `users`.`id` from `users` where `users`.`id`=108 
        );
    OPEN `noStocks_Cursor`; **// my cursor loop**
    noStocks_Loop: LOOP
        FETCH noStocks_Cursor INTO cv_user_id;
        IF finished=1 THEN 
            LEAVE noStocks_Loop;
        END IF;         

         UPDATE `payments` 
        SET `sale_id`=500
        WHERE `id`=_payment_id;
        SET  output_id=cv_user_id; 
    END LOOP noStocks_Loop;
    CLOSE `noStocks_Cursor`;     **// my cursor loop end**
    SELECT  output_id AS output_txt;    **// my output select**
COMMIT;

结束

最后这是我的 php 代码:

$_dbHandle = ' ';
$_PDOst = '';
function query($query)
{
    global $_PDOst;
    global $_dbHandle;
    $_PDOst = $_dbHandle->prepare($query);  
    $p_1='1134';
    $p_2='7';
    $_PDOst->bindParam(1, $p_1, PDO::PARAM_STR|PDO::PARAM_INPUT_OUTPUT);        
    $_PDOst->bindParam(2, $p_2, PDO::PARAM_STR|PDO::PARAM_INPUT_OUTPUT);        
    $result=$_PDOst->execute();
    $numOfRows = $_PDOst->rowCount();
    echo $numOfRows;
}
function connect($address, $account, $pwd, $name)  
{
    global $_dbHandle;

    if(isset($_SESSION['db_connection_counter']))
    $_SESSION['db_connection_counter']=$_SESSION['db_connection_counter']+1;

    $options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8'); 
    try
    {
        $_dbHandle = new PDO("mysql:host={$address};dbname={$name};charset=utf8", $account, $pwd,$options );
        $_dbHandle->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
        $_dbHandle->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
        $_dbHandle->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); 
        return 1;
    }
    catch (PDOException $e)
    {
        die("no_connection");
        return 0;
    }

}
connect('127.0.0.1','root','','db1');
query("CALL `pr_test` (?,?)");

我的 php 代码中的“查询”函数返回 0，这是由于过程的最后一次选择而应为 1 的输出记录数。

Answer 1

我发现了! pdo 的这个属性应该是 true，因为它是默认值，我已将其更改为 false 以进行 sql 注入(inject)攻击。

setAttribute(PDO::ATTR_EMULATE_PREPARES, true);