PHP bind_param(): Number of variables doesn't match number of parameters in prepared statement

Question

I'm searching and searching but i didnt find the problem, hope you can help me:

"Warning: mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters in prepared statement in "mydir" on line 24"

<?php
class Tunier {

    // name of Tunier
    protected $tunier_name;
    // count of participants
    protected $participant_count;

    function __construct($name, $participant) {
        // mysqli connection
        $db = new mysqli('localhost','root','','tuniere') or die ('Cant connect to MySql Please try later again');

        $this->tunier_name = $name or die('---');
        $this->participant = $participant or die('---');

        // einrichtung der Tabelle
        $query = 'CREATE TABLE `?`(
                                                    `?` VARCHAR(32) PRIMARY KEY NOT NULL,
                                                    `?` INT(2) NOT NULL,
                                                    `id_spieler` INT(10) NULL                            
                                                    );';

        $stmt = $db->prepare($query);        
        $stmt->bind_param('sss', $this->tunier_name, $this->tunier_name, $this->participant_count);
        $stmt->execute();
    }
}
?>

Álvaro González · Accepted Answer · 2013-04-27 09:49:47Z

3

I'm afraid that you are misusing the prepared statements feature. Bind parameters are intended to inject data into your queries (numbers, literal strings...) not to inject operators, identifiers or keywords. There's no way to protect against SQL injection if you accept SQL commands from untrusted sources. In other words: you cannot pass table or column names as bind parameters.

The SQL parser does not just replace all ? symbols blindly—it's a context sensitive tool. As a consequence, this:

`?`

... is not considered a placeholder but a literal identifier, thus the error.

E.g., in the following code:

SELECT *
FROM `?`
WHERE foo=? OR bar='?' OR dot='How are you doing?'

... we have up to ? symbols but the parser will only treat as placeholder the one at foo=? because, when code is parsed as SQL, that ? is the only one that's located where literal values are expected. So:

The code will only run if you pass one parameter.
The query fill fail if you don't have a table called ?.

edited Apr 27, 2013 at 9:49

answered Apr 27, 2013 at 7:34

Álvaro González

147k45 gold badges282 silver badges378 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Nextar Over a year ago

i think i dont really unterstand your statement, im just inject data in my uery or not ?

Álvaro González Over a year ago

@user2316478 I'll use different words: you cannot pass table or column names as bind parameters.

Nextar Over a year ago

ah okay :), i thought i could like when im inserting data with the INSERT INTO statement

Ranjith · Accepted Answer · 2013-04-27 07:35:21Z

0

No need bind_param() for your table_name

Change Integer type for participant_count in bind_param()

$stmt->bind_param('ssi', $this->tunier_name, $this->tunier_name, $this->participant_count);

answered Apr 27, 2013 at 7:35

Ranjith

2,8393 gold badges24 silver badges42 bronze badges

Collectives™ on Stack Overflow

PHP bind_param(): Number of variables doesn't match number of parameters in prepared statement

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related