title: Insert Data in Oracle DB using PHP
body: <p>Inserting data in oracle DB using <code>oci_8</code>. Sample query to insert string with special characters or quotes</p>
  
  <pre><code> update TABLENAME set COMMENTS = 'As per Mark's email dated 28-Feb-2015 - Bill Gates &amp; Team's effort' where ID = 99;
  </code></pre>
  
  <p>To insert/update</p>
  
  <pre><code>$query = 'update TABLENAME set COMMENTS = '$_POST[comments]';
  
  $result = customexecute($new_query);
  
  public function customexecute($query)
  {
  
      $resutlt = parent::customquery($query);
      return $resutlt;
  }
  
  
  public static function customquery($query)
  {
  
    try{
  
          $stmt = oci_parse($conn, $query);
          oci_execute($stmt,OCI_COMMIT_ON_SUCCESS);
          oci_commit(db_singleton::getInstance());
          oci_free_statement($stmt);
          }catch (Exception  $e)
          {
              print_r($e);
          }
  
      }
  </code></pre>
  
  <p>Executing it on ORACLE DB it says <code>SQl command not properly ended.</code> Looked into <code>Parameterized queries</code> mentioned <a href="http://php.net/manual/en/pdo.prepared-statements.php" rel="nofollow">here</a> but not able to integrate it succesfully.</p>
  
  <pre><code>$query = 'UPDATE tablename SET field = :field WHERE id = :id';
  $stmt = oci_parse($oracleConnection, $query);
  oci_bind_by_name($stmt, ':field', "The field value with 'apostrophes' and so");
  oci_bind_by_name($stmt, ':id', '125');
  $result = oci_execute($stmt);
  </code></pre>
  
  <p>I can pass <code>:bind_comments</code> in my query which is in my controller. But <code>$stmt</code> resides in my <strong>db_singleton</strong> file (general for all DB queries) and can not pass seperately for a individual query.</p>
  
  <p><strong>How can I sanitize user input or do not allow data to be used in creating SQL code</strong></p>