‫In the last video, we set it up so that we use PDO to select all of our posts, and we put them on
‫the index.php page.
‫Okay, we're bringing in our database, which has our connection and our PDO instance.
‫Now I want to make it so we can fetch a single post.
‫And I want to be able to click on one of these titles.
‫And it takes me to that particular post page.
‫And remember, we can use the get Superglobal to pass data through the URL.
‫So I want to be able to do something like this slash post dot php and then id equals one.
‫That way I can I can grab that and I can fetch the the post with that, with that ID.
‫So the first step is in the index dot PHP.
‫Let's come down to where the title is.
‫I'm just going to close this for a second.
‫So where we have the title and we're going to wrap that in an A tag.
‫Okay, we'll put the ending a tag right after the title and in the href for that, what I want to do
‫is say post dot php question mark and then id equals.
‫And then we're going to open up our shorthand PHP tags.
‫And remember we have access to that post and we have access to the ID.
‫So I want to get that put that in there.
‫All right.
‫So now if I reload you'll see down here at the bottom left it says ID equals one.
‫This one says ID equals two.
‫This one says id equals three.
‫Now I've created a post dot php file which just has HTML in it.
‫Just just some, you know, hard coded post one.
‫This is post one.
‫So if I click on this it'll go to that correct URL.
‫But we're not actually getting data from the database.
‫If I go back and I click on post two, it still says post one, right.
‫Because it's just hard coded.
‫So just create a new file called post PHP and then add this dummy code.
‫And I have this all in the PHP sandbox starter for this lesson.
‫Now this I'm going to demonstrate to you why prepared statements are so important as well.
‫So let's go up to the top here.
‫And let's open up our PHP tags.
‫And we want to get that ID.
‫And remember we can use the get superglobal.
‫So I'm going to say id equals and then get and then id and we'll say.
‫Get that or our ID is null.
‫We need to check for it.
‫Or else if there is no ID, we'll get an error.
‫So what I want to do now is use that ID.
‫In fact, let's just make sure that we're getting that.
‫So if I echo ID and I go to this page here and reload, you'll see I'm getting that too.
‫That's in the URL.
‫So we want to use this to first of all let's let's make it so that if we go to post dot PHP without.
‫Without an ID that we get redirected.
‫We don't want to get some weird error, we just want to redirect them back to the index page.
‫So we can do that by simply saying if.
‫Not ID.
‫So basically if its null, right?
‫Because if its not there then this is going to be null.
‫Then let's redirect and we can do that using the header function.
‫So header can take in location colon and then where we want to direct them to.
‫So we want to go to index PHP.
‫And then let's just exit the script.
‫So we'll call exit.
‫All right.
‫So now if I come here and there's no ID and I reload I get redirected back to the index page.
‫Okay.
‫So let's go back to post two.
‫And now let's fetch the data from the database.
‫Now we want to use that ID and we're going to create an SQL statement here I should say an SQL query.
‫And we want to select let's say select all.
‫So we want all the fields or all the columns from posts where the id.
‫Is equal to.
‫And then let's concatenate ID.
‫All right.
‫Now this is a huge no no this is very dangerous.
‫And let me show you why.
‫So if I echo out SQL right.
‫And I'm just echoing it.
‫But let's say that we're actually running this on our database.
‫So right now it's fine right.
‫We're getting from post where ID equals to.
‫But what if some brick comes along and does this.
‫So we'll say two semicolon and then let's say drop table.
‫Pose.
‫All right, so what if we do that?
‫Look, look what the look what query we're getting.
‫Now select all from post where id equals two.
‫That's one query.
‫And then we're saying drop table post.
‫So we're going to delete the entire post table.
‫So our whole website is ruined.
‫All of our posts are gone.
‫So that's why you can't just stick user input into a query like this.
‫You have to use prepared statements where it doesn't treat it like a query.
‫It treats it like a string and it prepares the query for you.
‫All right, so let's not do that.
‫What we do want to do is say where ID equals and then we use a placeholder.
‫And we do that with a colon.
‫So we say colon colon ID or whatever it is you're, you're looking up or looking up by which in this
‫case is the ID.
‫So now what we can do is.
‫Is create our statement.
‫So just like we did when we selected all.
‫Now the difference between this and what we did here is we're not using any user input here.
‫Right.
‫We're still using a prepared statement.
‫But there's no user input.
‫There's no placeholders.
‫It's just select all from posts here.
‫We're actually using user input.
‫So we have to be careful.
‫So let's create the statement.
‫We'll call it st stmt or st whatever you want to call it.
‫And we'll say PDO and we want to prepare.
‫And then we can pass in that SQL query.
‫Okay.
‫Now we have to basically replace the placeholder with the actual ID so that that's going to happen in
‫the execute.
‫We can get rid of this echo.
‫So remember we take our statement and we execute.
‫And then in here you can pass in an array and say we want to replace ID.
‫With the ID.
‫That's from the from the get.
‫Okay.
‫And what I usually like to do is instead of passing the array directly in is put it in a params variable.
‫Like that.
‫Okay.
‫So now it's just going to look at whatever's passed in as a string.
‫And it's going to then prepare the query rather than just, you know, running whatever the user puts
‫in.
‫And then the last thing we need to do is fetch the data.
‫So we'll say post and we'll set that to our statement.
‫And then since we're such fetching just one post instead of fetch, all we're going to be using fetch.
‫Now we can simply come down here and we have post one and the title.
‫Let's replace that and we can just do this.
‫We can say post title.
‫Close that up.
‫And then let's put the title also down here in the page in the H two.
‫And then we want the body here.
‫So replace that with body.
‫So we don't have to do any loops because it's we don't have to loop through it.
‫It's just a single post.
‫So let's save that.
‫And now when I reload.
‫Undefined variable PDO.
‫So I forgot to bring in the database.
‫We want to make sure that we require.
‫That database file.
‫And there we go.
‫So now we see post two.
‫This is post two.
‫The title also says post two.
‫If we go back and we go to post three, then we're getting post three.
‫Post one.
‫All right.
‫So now we're able to fetch a single post based on that query param of ID.
‫But hopefully you can see how important prepared statements are in the next video.
‫We're going to insert data.
‫We're going to have a form where we can actually submit and insert the data into our database.