由于我注意到我的网站易受SQL注入攻击，我已从使用标准的mysqli连接协议切换到PDO。
自从构建新的连接和查询脚本以来，我不断地抛出这个错误
警告：PDOStatement:：execute（）：SQLSTATE[HY093]：无效参数编号：第31行的D:''wamp''www''Kerr Pumps''includes''product_data.php中未定义参数
尽管访问了其他论坛的帖子，我还是没能找到解决我问题的方法。
// Get a list of all the pumps in the database
function get_pumps( $pType, $pVal, $gVal, $class_style ) {
// PDO DB CONNECTION AS OF VERSION 1.1
// Check whether correct data is passed into function...
echo var_dump($pType);
echo var_dump($pVal);
echo var_dump($gVal);
// Local connection variables
$db_user = "root";
$db_pass = "root";
// Connect to the database
try
{
$connection = new PDO('mysql:host=localhost;dbname=kerrpumps', $db_user, $db_pass );
$stmt = $connection->prepare('SELECT * FROM pumps WHERE pump_type = :pType AND flow_psi = :pVal AND flow_gpm = :gVal AND high_psi = :pVal AND high_gpm = :gVal');
$stmt->execute(array( 'pump_type' => $pVal,
'flow_psi' => $pVal,
'flow_gpm' => $gVal,
'high_psi' => $pVal,
'high_gpi' => $gVal ));
$result = $stmt->fetchAll();
// If there are results...
if ( count($result) )
{
foreach($result as $row){
$link = '#';
echo '<tr onclick="'."$link; window.location='$link'".'" class="'.($class_style %2 == 0 ? "row_dark" : "row_light").'">';
echo '<a href="#">';
include("grid_data.php");
echo '</a>';
$class_style++;
echo "</tr>";
}
}
// Else there are no results which match the query...
else {
echo "<tr class='styleOff'>
<td class='styleOff'>We're sorry, but there are no pumps which fit the given search criteria. Please try again.</td>
</tr>";
}
}
// Error handling
catch(PDOException $e) {
echo 'ERROR: ' . $e->getMessage();
}
}
如上所述，我是PDO的新手，可能错过了一些简单的东西，任何反馈或建议都将不胜感激，谢谢。
传递给->execute()调用的数组键应该与您正在使用的占位符的名称匹配，而不是与占位符进行比较的字段：
SELECT * FROM pumps WHERE pump_type = :pType AND flow_psi = :pVal AND flow_gpm = :gVal AND high_psi = :pVal AND high_gpm = :gVal
^^^^^---- use this instead
$stmt->execute(array('pType' => 'foo', ....));
^^^^^--- use the placeholder name, NOT the field name