[RESOLVED] Procedural Binding Help!

condoug

Hi alll

My first attempt at using mysqli_prepare() is failing and an am stumped as to what I am doing wrong. Here is my query which simply needs to pull out records and display then in a select list:

<?php
    $query 	= "SELECT eventcategoryid, eventcategoryname FROM tbleventcategories WHERE publish = 1 AND siteid = ?";
	$stmt 	= mysqli_prepare($dblink, $query);
	mysqli_execute($stmt);
	mysqli_stmt_bind_param($stmt, "i", 1);
	mysqli_stmt_bind_result($stmt, $eventcategoryid, $eventcategoryname);

while(($res = mysqli_stmt_fetch($stmt))) {
?>
            <option value="<?php echo $eventcategoryid; ?>"><?php echo $eventcategoryname; ?></option>
<?php	
    }
    mysqli_stmt_close($stmt);
?>

My understanding is that the mysqli_stmt_bind_param is the function which holds the variables I would normallly write directly int he WHERE clause of a query but I am getting a Fatal Error one htis line: Only variables can be passed by reference.

Can someone help me out and highlight the error in the code?

bradgrafelman

Why are you trying to bind a constant value to a parameter? Why not just use the constant value inside a query rather than a prepared statement?

EDIT: Note that if your intent is to later replace the constant integer 1 with a user-supplied value and wish to use prepared statements for now then you'll need to assign that value to a variable and use the variable in the call to [man]mysqli_stmt_bind_param/man. As you'll see on the manual page for that function, there are two key indicators that what you're currently trying to do won't work:

The function description explains that it is used to bind variables as parameters (not variables or scalar values).
The function prototype/declaration at the beginning of the Description section shows ampersands ("&") in front of the 3rd - nth parameters; this indicates that these arguments will be passed by reference - see the PHP manual for more about [man]references[/man].

condoug

HI bradgrafelman

This is the intention yes, the code I used in my post is kind of in debug mode. This is the real code where I get a user to select something in the form and it POST's the form and the user input is part of the query:

    $userinput = trim($_POST['userinput'])	?	$_POST['userinput']	:	1;

$query 	= "SELECT eventcategoryid, eventcategoryname FROM tbleventcategories WHERE publishtoweb = 1 AND siteid = ?";
$stmt 	= mysqli_prepare($dblink, $query);
mysqli_execute($stmt);
mysqli_stmt_bind_param($stmt, "i", $userinput);
mysqli_stmt_bind_result($stmt, $eventcategoryid, $eventcategoryname);

What am i missing?

bradgrafelman

condoug;11029547 wrote:
What am i missing?

Well for starters, you're missing a description of what's wrong with this new code snippet.

Second problem I see is that you're executing the prepared statement before you ever bind any parameters or result variables to it.

Third problem I see is that you're never checking to see if your statement was successfully prepared or executed (something you should always, IMHO, be doing).

condoug

Second problem I see is that you're executing the prepared statement before you ever bind any parameters or result variables to it.

That was my problem and changing this has fixed it. Thank you.