mysqli_stmt::bind_param() variable doesn't match

Question

What's going wrong in this script it is giving me error for bind_param

if(isset($_GET['ID'])){

$page_id = $_GET['ID'];

      $page_id = mysqli_real_escape_string($con, $page_id);



$select_query = $con->prepare("select * from save_data where ID='$page_id'")
    or die(mysqli_error($con)); 

$select_query->bind_param('i', $page_id);

$select_query->execute();

$result = $select_query->get_result();

Getting this error

Warning: mysqli_stmt::bind_param(): Number of elements in type definition string doesn't match number of bind variables in C:\xampp\htdocs\mysql_login\pictures.php on line 23

If you want to use placeholders, then you do NOT escape the data that will be used for that placeholder. it'll effectively double-escape the data and lead to trouble down the road. — Marc B
– Marc B, Commented Dec 23, 2013 at 14:39

Amal · Accepted Answer · 2013-12-24 07:07:32Z

5

You are not using a placeholder in your query. You inadvertently put the variable you wish to replace it with instead:

$select_query = $con->prepare("select * from save_data where ID='$page_id'")

should be:

$select_query = $con->prepare("select * from save_data where ID=?")

edited Dec 24, 2013 at 7:07

Amal

76.8k18 gold badges133 silver badges154 bronze badges

answered Dec 23, 2013 at 14:08

John Conde

220k100 gold badges464 silver badges504 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

ThiefMaster · Accepted Answer · 2013-12-23 14:08:34Z

2

You want this instead of the line you have:

$select_query = $con->prepare("select * from save_data where ID=?");

In the code you posted you don't use parameter binding at all - you interpolate the variable directly into the SQL string. For parameter binding you need to insert a ? placeholder instead!

Also, please don't use or die(mysqli_error($con) for debugging. That's extremely hacky. Either just let it fail with an exception (mysqli does have an option for this, right?) or write custom wrapper that handles error properly without requiring you repeat the same code every time you perform a query!

answered Dec 23, 2013 at 14:08

ThiefMaster

320k85 gold badges608 silver badges648 bronze badges

1 Comment

John Conde Over a year ago

I'd like to know, too. This answer is both correct and informative.

Collectives™ on Stack Overflow

mysqli_stmt::bind_param() variable doesn't match

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related