<?xml version='1.0' encoding='iso-8859-1'?>
<!-- $Revision: 1.4 $ -->
<refentry id="function.SDO-DAS-Relational-executePreparedQuery">
 <refnamediv>
  <refname>SDO_DAS_Relational::executePreparedQuery</refname>
  <refpurpose>
   Executes an SQL query passed as a prepared statement, with a 
   list of values to substitute for placeholders, and return the 
   results as a normalised data graph.
  </refpurpose>
 </refnamediv>

 <refsect1 role="description">
  &reftitle.description;
  <methodsynopsis>
   <type>SDODataObject</type>
   <methodname>SDO_DAS_Relational::executePreparedQuery</methodname>
   <methodparam>
    <type>PDO</type>
    <parameter>database_handle</parameter>
   </methodparam>
   <methodparam>
    <type>PDOStatement</type>
    <parameter>prepared_statement</parameter>
   </methodparam>
   <methodparam>
    <type>array</type>
    <parameter>value_list</parameter>
   </methodparam>
   <methodparam choice="opt">
    <type>array</type>
    <parameter>column_specifier</parameter>
   </methodparam>
  </methodsynopsis>
	
	  &warn.experimental.func;
	
  <para>
   Executes a given query against the relational database, 
   using the supplied PDO database handle.
   Differs from the simpler 
   <function>executeQuery</function>
   in that it takes a prepared statement and a list of values.
   This is the appropriate call to use either when the statement is 
   to executed a number of times with different arguments, and there
   is therefore a performance benefit to be had from preparing the 
   statement only once, or when the the SQL statement is to contain 
   varying values taken from a source that cannot be completely trusted.
   In this latter case it may be unsafe to construct the SQL statement
   by simply concatenating the parts of the statement together, 
   since the values may contain pieces of SQL. 
   To guard against this, a so-called SQL injection attack,
   it is safer to prepare the SQL statement with placeholders 
   (also known as parameter markers, denoted by '?') and supply a 
   list of the values to be substituted as a separate argument. 
   Otherwise this function is the same as 
   <function>executeQuery</function> in that 
   it uses the model that it built from the the metadata 
   to interpret the result set and returns a data graph.
  </para>
 </refsect1>

 <refsect1 role="parameters">
  &reftitle.parameters;
  <para>
   <variablelist>
    <varlistentry>
     <term>PDO_database_handle</term>
     <listitem>
      <para>
       Constructed using the PDO extension. 
       A typical line to construct a PDO database handle might look 
       like this:
       <programlisting role="php" id="sdo.das.rel.epq.examples.pdo">
<![CDATA[
$dbh = new PDO("mysql:dbname=COMPANYDB;host=localhost",DATABASE_USER,DATABASE_PASSWORD);
]]>
       </programlisting>
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term>prepared_statement</term>
     <listitem>
      <para>
       A prepared SQL statement to be executed against the database.
       This will have been prepared by PDO's
       <function>prepare</function>
       method.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term>value_list</term>
     <listitem>
      <para>
       An array of the values to be substituted into the 
       SQL statement in place of the placeholders. In the event
       that there are no placeholders or parameter markers in the
       SQL statement then this argument can be specified as &null;
       or as an empty array; 
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term>column_specifier</term>
     <listitem>
      <para>
       The Relational DAS needs to examine the result set and 
       for every column, know which table and which column of 
       that table it came from.
       In some circumstances it can find this information for itself, 
       but sometimes it cannot.
       In these cases a column specifier is needed, 
       which is an array that identifies the columns.
       Each entry in the array is simply a string in the form
       <varname>table-name.column_name</varname>.
      </para>
	          

      <para>
       The column specifier is needed when there are duplicate 
       column names in the database metadata,
       For example, in the database used within the examples, 
       all the tables have both a
       <varname>id</varname>
       and a
       <varname>name</varname>
       column.
       When the Relational DAS fetches the result set from PDO 
       it can do so with the PDO_FETCH_ASSOC attribute, 
       which will cause the columns in the results set 
       to be labelled with  the column name, but will not distinguish 
       duplicates.
       So this will only work when there are no duplicates 
       possible in the results set.
      </para>
	          
      <para>
       To summarise, specify a column specifier array whenever there 
       is any uncertainty about which column could be from which table and
       only omit it when every column name in the database metadata is unique.
      </para>
	          
      <para>
       All of the examples in the
       <link linkend='sdo.das.rel.examples'>Examples</link>
       use a column specifier.
       There is one example in the
       <filename>Scenarios</filename>
       directory of the installation that does not: 
       that which works with just the employee table, 
       and because it works with just one table, 
       there can not exist duplicate column names.
      </para>
     </listitem>
    </varlistentry>
   </variablelist>
  </para>
 </refsect1>

 <refsect1 role="returnvalues">
  &reftitle.returnvalues;
  <para>
   Returns a data graph. 
   Specifically, it returns a root object of a special type.
   Under this root object will be the data from the result set.
   The root object will have a multi-valued containment property 
   with the same name as the application root type 
   specified on the constructor,
   and that property will contain one or more data objects 
   of the application root type.
  </para>
  <para>
   In the event that the query returns no data, 
   the special root object will still be returned but 
   the containment property for the application root type will be empty.
  </para>
 </refsect1>
	
 <refsect1 role="errors">
  &reftitle.errors;
  <para>
   <function>SDO_DAS_Relational::executeQuery</function>
   can throw an SDO_DAS_Relational_Exception if it is unable 
   to construct the data graph correctly.
   This can occur for a  number of reasons: 
   for example if it finds that it does not have primary keys 
   in the result set for all the objects.
   It also catches any PDO exceptions and obtains PDO 
   diagnostic information which it includes in an 
   SDO_DAS_Relational_Exception which it then throws.
  </para>
 </refsect1>
	
 <refsect1 role="examples">
  &reftitle.examples;
  <para>
   <example>
    <title>Retrieving a data object using
    <function>executePreparedQuery</function></title>
    <para>
     In this example a single data object is retrieved from the database 
     - or possibly more than one if there is more than one company 
     called 'Acme'. For each company returned, the
     <varname>name</varname>
     and
     <varname>id</varname>
     properties are echoed.
    </para>
    <para>
     Other examples of the use of 
     <function>executePreparedQuery</function>
     can be found in the example code supplied in 
     <filename>sdo/DAS/Relational/Scenarios</filename>
     .
    </para>
    <programlisting role="php" id="sdo.das.rel.functions.epq.1c-R">
<![CDATA[
<?php
require_once 'SDO/DAS/Relational.php';
require_once 'company_metadata.inc.php';

/**************************************************************
 * Construct the DAS with the metadata
 ***************************************************************/
$das = new SDO_DAS_Relational ($database_metadata,'company',$SDO_reference_metadata);

/**************************************************************
 * Get a database connection
 ***************************************************************/
$dbh = new PDO(PDO_DSN,DATABASE_USER,DATABASE_PASSWORD);

/**************************************************************
 * Issue a query to obtain a company object - possibly more if they exist
 * Use a prepared query with a placeholder.
 ***************************************************************/
$name = 'Acme';
$pdo_stmt = $dbh->prepare('select name, id from company where name=?');
$root = $das->executePreparedQuery(
    $dbh, 
    $pdo_stmt,
    array($name), 
    array('company.name', 'company.id'));

/**************************************************************
 * Echo name and id 
 ***************************************************************/
foreach ($root['company'] as $company) {
	echo "Company obtained from the database has name = " . 
    $company['name'] . " and id " . $company['id'] . "\n";
}
?>
]]>
    </programlisting>
   </example>
  </para>
 </refsect1>
</refentry>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
indent-tabs-mode:nil
sgml-parent-document:nil
sgml-default-dtd-file:"../../../../manual.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
vim600: syn=xml fen fdm=syntax fdl=2 si
vim: et tw=78 syn=sgml
vi: ts=1 sw=1
-->