MySQLi Prepare statement

Question

Clearly there something I miss when I try to do my prepare statement for a SELECT query.

Can any body tell me how the correct version is:

$db = new mysqli($config_databaseServer, $config_databaseUsername ,$config_databasePassword, $config_databaseName);

if(isset($_POST['queryString'])) {
            $queryString = $db->real_escape_string($_POST['queryString']);
            
            if(strlen($queryString) >3) {
                
                $numberOfProducts = $_POST['numberOfProducts'];
                $numberOfBrands = $_POST['numberOfBrands'];
                $query = $db->prepare("SELECT name, image_url FROM `".$config_databaseTablePrefix."products` WHERE name LIKE '?%' LIMIT ?");
                $query->bind_param('ss', $queryString, $numberOfProducts);
                $query->execute();
                if($query) {
                   while ($result = $query ->fetch_object()) {
                code continues..

Error:

Warning: mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters in prepared statement

Fatal error: Call to undefined method mysqli_stmt::fetch_object()

I only have two variables?

`'?%'` that isn't the right syntax. The `?` is passed as a string literal. — Funk Forty Niner, Nov 04 '15 at 18:00
See this Q&A http://stackoverflow.com/questions/14872029/php-binding-a-wildcard and your `s` bind for the LIMIT should be an `i`. It's an integer, not a string. — Funk Forty Niner, Nov 04 '15 at 18:03
You don't need to escape it since you are parameterizing it. — chris85, Nov 04 '15 at 18:10
@pnuts Just to clarify, TaggerBot *is* a script, not a person, and won't necessarily have me picking up on pings... Anyway, it's focused on adding relevant tags at the moment, and I want to get that working before I try anything new. — ArtOfCode, Nov 04 '15 at 21:37

MySQLi Prepare statement

0 Answers0