0

Im in a situation where a mysqli query is created dynamically from $_GET values, which are always changing depending on the custom searches made . Would it be possible to pass a correctly formatted (and dynamically created) string to show the different variables in question.

Example: $variabletypelist = "sss"; $variablestring = "$dogs, $cats, $weasels";

$stmt->bind_param($variabletypelist, $variablestring);

So that the end result would look similar to 

stmt->bind_param($variabletypelist,$dogs, $cats, $weasels)

I realise there is this a problem since $variablestring is being taken as the variable to be bound to instead of binding to $dogs, $cats, $weasels.

Is there any simple way to do this with a string for the variables?

Maximilian Travis
  • 311
  • 1
  • 3
  • 12
  • Why on earth would you do that when you have arrays? – Havenard Apr 04 '17 at 19:28
  • 1
    If you can convert your `$dynamicvariablestring` into an array, then you can call bind_param like this: `array_unshift($params, $variabletypelist); call_user_func_array(array($stmt, 'bind_param'), $params);` – Dave Chen Apr 04 '17 at 19:31
  • Note that I first insert the variabletypelist at the beginning of the list of parameters that you want to bind. – Dave Chen Apr 04 '17 at 19:32
  • Im interested because you can easily implode an array into a string. and wondering if you can just put in the contents of $variablestring with something like {$variablestring} or another shorthand/function that returns the value of $variablestring – Maximilian Travis Apr 04 '17 at 19:32
  • [`bind_param()`](http://php.net/manual/en/mysqli-stmt.bind-param.php) expects the first argument as a type. Either `i,d,s,b`. We also don't know what you assigned `$variabletypelist` as, so that part's unclear. – Funk Forty Niner Apr 04 '17 at 19:32
  • Dave Chen's solution looks like it would work and I think I've seen it in other places just didn't understand until he explained it. Still think its suprising you can't just plug in variables in bind_param()!!! – Maximilian Travis Apr 04 '17 at 19:36
  • Fred- edited to show what $variabletypelist is – Maximilian Travis Apr 04 '17 at 19:44
  • 1
    Possible duplicate of [Bind multiple parameters into mysqli query](http://stackoverflow.com/questions/17870999/bind-multiple-parameters-into-mysqli-query) – miken32 Apr 04 '17 at 19:56
  • 1
    You should look at PDO. No binding is needed, parameters are passed as a simple array. Much easier! – miken32 Apr 04 '17 at 19:57

1 Answers1

2

There's a number of solutions to call mysqli_stmt::bind_param with a dynamic number of parameters, none of them involve describing a list as a string, that's just dumb. When you need a list, you use an array.

You can use call_user_func_array() to call any function in PHP specifying the parameters it should be called with in an array. It creates a problem though because the paramters of mysqli_stmt::bind_param have to be passed as reference and not by value, but workarounds can be made.

Example:

$vars = [$dogs, $cats, $weasels];
$refs = [$variabletypelist];

foreach ($vars as &$val)
    $refs[] = &$val;
call_user_func_array([$stmt, 'bind_param'], $refs);

You can also use the non-oop version of this method if this syntax looks confusing to you:

$vars = [$dogs, $cats, $weasels];
$refs = [$stmt, $variabletypelist];

foreach ($vars as &$val)
    $refs[] = &$val;
call_user_func_array('mysqli_stmt_bind_param', $refs);

It can also be done with ReflectionClass() that (I didn't test) apparently doesn't require fixing references:

$vars = [$dogs, $cats, $weasels];

$ref = new \ReflectionClass('mysqli_stmt');
$met = $ref->getMethod('bind_param');
$met->invokeArgs($stmt, array_merge([$variabletypelist], $vars));
Havenard
  • 27,022
  • 5
  • 36
  • 62
  • hey thank you so much for this varied answer! I was wondering about the last one. You said that it apparently doesn't require fixing references. What is meant by 'fixing', since I see $variabletypelist is included, just not expressly defined in the example. – Maximilian Travis Apr 04 '17 at 22:18
  • 1
    @MaxTravis `mysqli_stmt::bind_param` requires that each parameter, beside the first one specifying the types, to be passed by reference. The way `call_user_func_array` works will force parameters to be sent by value, causing problems there, but the way `ReflectionClass` does it won't have the same issue. Knowing exactly how and why would require checking the inner works of the PHP interpreter and the MySQLi extension. – Havenard Apr 05 '17 at 02:06