I have been trying to learn prepared statements so that we can start implementing them thoughout our PHP sites. This function takes values (or none) from text boxes on a search form using the $_POST transfer method then uses the names and values of those textboxes to add criteria to the WHERE clause. The function worked previously ut I can't seem to get the prepared statement to function.
Researching several scripts I started using the one below and worked out a few bugs. now when I run it I get the error Wrong parameter count for mysqli_stmt::bind_param()
After this query runs I want to export the values into a table and was working before attempting the prepared statement.
Here is the code I have so far:
<?php
$db = mysqli_connec("ip_address", "loginname", "password", "database");
$refs = array('sssss');
foreach ($_POST as $key => $value)
{
$refs[] =& $_POST[$key];
}
$query = "SELECT col1, col2, col3, col4, col5 FROM tbl_name WHERE 1=1";
foreach ($_POST as $k => $v)
{
if(!empty($v)) {
$query .= " AND $k = ?";
$params[$k] = $v;
}
}
$results = $db->prepare($query);
call_user_func_array(array($results, 'bind_param'), $refs);
$results->execute();
?>