PHP Call to a member function execute() on boolean, can't find what's wrong

Question

my php function is not working and I can't find out why, it is throwing the "Call to a member function execute() on boolean" error in my face, can anyone tell me what I'm doing wrong?

$projectName = $_POST['project_name'];

$getProjectId = $mysqli->prepare('SELECT project_id FROM projects WHERE project_name = '.$projectName);
$getProjectId->execute();
$getProjectId->bind_result($projectId);
$_SESSION['projectID'] = $projectId;

And yes the database connection is OK, It works in other functions.

Your prepare statement failed. Check for errors instead of blindly assuming it works. I'm guessing it's because you're not quoting your projectName. Since you're using mysqli and a prepared statement, use a bind_param to prevent SQL injection and to pass the values in properly. — aynber, Nov 07 '16 at 21:25
You're using prepared statements (nice!), but take one more step and use [bound parameters](http://php.net/manual/en/mysqli-stmt.bind-param.php) to avoid problems like this and make your code more secure — Dan, Nov 07 '16 at 21:49
While the post *is* a duplicate as linked, I would think as a beginner at MySQL, the wall of information presented in the linked topic would be quite intimidating and/or confusing to a new(ish) programmer. — Martin, Nov 07 '16 at 21:59

score 2 · Answer 1 · edited May 23 '17 at 12:01

You're doing it wrong.

The whole point (well, one of the main ones) of using Prepared Statements is that you set the statement and then separately insert the variables so that the variables are never a risk to the SQL statement.

Your SQL query:

$getProjectId = $mysqli->prepare('SELECT project_id FROM projects 
                WHERE project_name = '.$projectName);

What you currently have here is a prepared statement which is shaped as if it is a standard non-prepared old fashioned MySQLi statement. This means that the variable $projectName can contain any data and can directly abuse your SQL query.

What you need to do instead is to substitute the variable for placeholders and then add the variables later, this is called preparing the SQL, there is a LOT of guidance on Stackoverflow and the internet at large about doing this, so please, please research it, but the outcome will look like this:

    $getProjectId = $mysqli->prepare("SELECT project_id FROM projects 
                    WHERE project_name = ?");
    $getProjectId->bind_param("s",$projectName);
    $getProjectId->execute();

    //carry on as before

This bind_param code inserts the variable into the ? placeholder location, completely avoiding SQL injection issues.

Answering your Question

MySQL uses backticks

   ` <== This, typically next to the number 1 on your keyboard

and uses single quotes ', so when you have a column name and/or reference value names in an SQL string they will be encased in a single quote. This will cause you issues if you wrap the whole string in single quotes in PHP. This is the error you're facing here.

Your Original query:

   'SELECT project_id FROM projects WHERE project_name = '.$projectName

Should be (ignoring the detail above, that is really should be prepared properly):

 "SELECT project_id FROM projects WHERE project_name = '$projectName' "

I hope you can notice the string is now encased in double quotes and the column value is encased in single quotes.

Aslo, as stated by djxyz and Aynbar in comments, you really should look into getting error feedback so that MySQL can then tell you why a query doesn't work, error messages are very useful in both MySQL and PHP .

In Conclusion

Properly using prepared statements negates the main syntax error that you originally had with column names in quotes (unneeded if it's a placeholder ?). Always make a habit of writing SQL strings in double quotes " to sidestep these sort of issues.

Finally, do be careful as PDO and MySQLi have slightly different Prepared syntax (so when you're reading SO posts, try and establish if the code is MySQLi or PDO before copying it!

Using Prepared Statements properly will do wonders for your abilities as a coder. It will also keep your code much safer. And it can occasionally help you mingle at parties.

score 1 · Answer 2 · edited Nov 08 '16 at 13:35

1

$mysqli->prepare returns false when the query contains an error. You should check $mysqli->error and $mysqli->errno just after the prepare statement for finding out what is wrong with the query.

edited Nov 08 '16 at 13:35

Nisse Engström

4,738
23
27
42

answered Nov 07 '16 at 21:25

djxyz

125
4

1

While this is not quite an answer, it's a good practise to check error logs – Martin Nov 07 '16 at 21:34

PHP Call to a member function execute() on boolean, can't find what's wrong

2 Answers2

You're doing it wrong.

Answering your Question

In Conclusion