How to execute a secure query PHP

Question

$con = mysqli_connect('localhost', 'root','', 'dbname');
if(filter_input(INPUT_POST, "register")){
$username = filter_input(INPUT_POST,'username');
$password = filter_input(INPUT_POST,'password');
$email = filter_input(INPUT_POST,'email');

$stmtInsertUser = $con -> prepare("INSERT INTO tbl_users (username, password, email) values (?, ?, ?)");

$stmtInsertUser -> bind_param($username, $password, $email);

$stmtInsertUser -> execute();

}

This is my code and it returns this error

Warning: mysqli_stmt::bind_param(): Number of elements in type definition string doesn't match number of bind variables in C:\xampp\htdocs\xxx\xxx\PHPregister.php on line 10

Thanks!

Read the documentation for bind_param - your arguments are wrong. — Kryten
– Kryten, Commented May 9, 2014 at 22:25

skrilled · Accepted Answer · 2014-05-09 22:25:49Z

1

The first parameter of bind_param is a list of what types of inputs are coming in

Per the manual: http://www.php.net/manual/en/mysqli-stmt.bind-param.php (s is string)

$stmtInsertUser -> bind_param('sss',$username, $password, $email);

answered May 9, 2014 at 22:25

skrilled

5,3712 gold badges28 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

skrilled Over a year ago

Yes it does, the full list: i corresponding variable has type integer, d corresponding variable has type double, s corresponding variable has type string, b corresponding variable is a blob and will be sent in packets

Gogol · Accepted Answer · 2014-05-09 22:26:34Z

1

Try

$stmtInsertUser->bind_param('sss',$username, $password, $email);

answered May 9, 2014 at 22:26

Gogol

3,0604 gold badges32 silver badges64 bronze badges

Collectives™ on Stack Overflow

How to execute a secure query PHP

2 Answers 2

1 Comment

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Related