PHP's variable argument list (ellipsis) operator comes in handy for dynamic number of prepared statement replacements:
mysqli_stmt_bind_param($stmt, $params_types, ...$params);
An example:
$sql = 'SELECT * FROM Table WHERE one = ? AND two = ?';
$params_types = 'ii';
$params = array(1, 2);
// prepare
$stmt = mysqli_stmt_init($dbconn_read);
if ( mysqli_stmt_prepare($stmt, $sql) ) {
// bind and execute
mysqli_stmt_bind_param($stmt, $params_types, ...$params); // unpack array into arguments
mysqli_stmt_execute($stmt);
// get column names for binding return results
$resultmeta = mysqli_stmt_result_metadata($stmt);
list($columns, $columns_vars) = array(array(), array());
while ( $field = mysqli_fetch_field($resultmeta) ) {
$columns[] = $field->name;
$columns_vars[] = &${'column_' . $field->name};
}
// call bind function with arguments in array
call_user_func_array('mysqli_stmt_bind_result', array_merge(array($stmt), $columns_vars));
// get return results
$return_array = array();
while ( mysqli_stmt_fetch($stmt) ) {
$row = array();
foreach ( $columns as $col ) {
$row[$col] = ${'column_' . $col}; // populate assoc. array with data
}
$return_array[] = $row; // push row data onto return array
}
}
Even better incorporated in a function:
function db_query(&$dbconn, $sql, $params_types, ...$params) { // pack dynamic number of remaining arguments into array
// GET QUERY TYPE
$query_type = strtoupper(substr(trim($sql), 0, 4));
$stmt = mysqli_stmt_init($dbconn);
if ( mysqli_stmt_prepare($stmt, $sql) ) {
mysqli_stmt_bind_param($stmt, $params_types, ...$params); // unpack
mysqli_stmt_execute($stmt);
if ( 'SELE' == $query_type || '(SEL' == $query_type ) {
$result = mysqli_stmt_result_metadata($stmt);
list($columns, $columns_vars) = array(array(), array());
while ( $field = mysqli_fetch_field($result) ) {
$columns[] = $field->name;
$columns_vars[] = &${'column_' . $field->name};
}
call_user_func_array('mysqli_stmt_bind_result', array_merge(array($stmt), $columns_vars));
$return_array = array();
while ( mysqli_stmt_fetch($stmt) ) {
$row = array();
foreach ( $columns as $col ) {
$row[$col] = ${'column_' . $col};
}
$return_array[] = $row;
}
return $return_array;
} // end query_type SELECT
else if ( 'INSE' == $query_type ) {
return mysqli_insert_id($dbconn);
}
return 1;
}
}
Call it like this:
$records = db_query(
$dbconn_read,
'SELECT * FROM Table WHERE one = ? AND two = ?',
'ii', 1, 2
);