bind_param not working with values

Question

Some days ago I had this problem with bind_param and i found a temporarly solution, but this is not the right thing to do. I need to dinamically bind variables while registering a user, so I am using this with an INSERT INTO query. At beginning I thought it could be because I had to pass the value by reference, but as I read on php.net, since php 5.3 you don't have to pass the value by reference anymore. So i tried, tried and tried but can't understand where I am wrong.

// INSERT INTO
public function QueryInsert($table, $fields, $values, $format) {
    $values = explode(',',$values); // Metto i VALUES di Insert in un array        
    $placeholders = ""; // Inizializzo Segnaposto
    $data =  "";
    $i = 0;
    foreach($values as $k => $v) { // Creo i placeholders in base al numero di Valori VALUES
        $placeholders .= '?,';            
    }                     
    $placeholders = substr($placeholders, 0, -1); // Tolgo l'ultima virgola

    $DB = DBConn::ConnettiDB(); // Richiamo la funzione di connessione al DB        
    $statem = $DB->prepare("INSERT INTO $table($fields) VALUES ($placeholders)"); // Preparo query per inserimento                                     

    $statem->bind_param("$format",$values); // WORKING
    $statem->execute(); // Eseguo query INSERT        
    // Controllo se la query INSERT ha avuto successo
    if($statem->affected_rows != -1) {          
        return true;
    }           
    echo "<br>ERRORE Insert: <br>" . $statem->error;

} // FINE INSERT

I made this work by replacing this

$statem->bind_param("$format",$values); // WORKING

with this

$statem->bind_param("$format",$values[0],$values[1],$values[2]); // WORKING

since the $values is an array made with registration fields, so to add the user i have username, password and email, 3 fields, this way it works. The problem is I can't use this script to run dynamic queries, because it doesnt work with the line I said, with variable $values that is an array and I don't understand why bind_param doesn't accept it. Infact the error i get is:

No data supplied for parameters in prepared statement

Because it seems that bind_param can't work with that variable $values

I tried with call_user_function_array too, but didn't make it work either. Can someone tell me where i fail? Could it be the ref values thing? Because I am not sure, since I read that now you don't need to pass values by reference anymore. And I tried to do that too, it didn't work, maybe i didn't do the right way.

Answer 1

Two possibilities. One, as mentioned in comments, use call_user_func_array(), which allows you to pass an array of arguments to any function. EDIT: According to this answer, using call_user_func_array() with bind_param() is tricky.

array_unshift($values, $format);
$statem = $DB->prepare("INSERT INTO $table($fields) VALUES ($placeholders)");
call_user_func_array(
    array($statem, "bind_param"),
    refValues($values)
);
$statem->execute();

function refValues($arr){
    $refs = array();
    foreach($arr as $key => $value)
        $refs[$key] = &$arr[$key];
    return $refs;
}

Another might be more work but is worth investigating; you need to change your database object to PDO instead of mysqli. But then you can do this, because PDO has no binding of variables needed.

$statem = $DB->prepare("INSERT INTO $table($fields) VALUES ($placeholders)");
$statem->execute($values);
if($statem->rowCount() > 0) {
    return true;
}