How should a prepared selection in PHP be?

Question

I'm trying to secure my database from SQL-injections and I can't seem to make this statement to work. I've done this a few times already and those attempts work but not this one.

$stmt = $db->prepare("SELECT name, pass, email FROM users WHERE salt=?");

$stmt->bind_param("s", $salt); 
$stmt->execute(); 
$stmt->bind_result($stuff1,$stuff2,$stuff3);
$stmt->store_result();
while ( $stmt->fetch() ) {
  var_dump($stuff1." - ".$stuff2." - ".$stuff3."<br />");
  }
$stmt->free_result();
$stmt->close();

I've managed to get that it works all the way to execute by placing var_dumps but I don't get why the results/fetch don't work. Is there a simple explanation to what I've missed?

EDIT: What I'm expecting is to retrieve name, pass and email from my table but instead I just get NULL.

Answer 1

Try this:

if($stmt = $db->prepare("SELECT name, pass, email FROM users WHERE salt=?")) {
    $stmt->bind_param("s", $salt); 
    $stmt->execute(); 
    $stmt->bind_result($name, $pass, $email);
    while ($stmt->fetch()) {
        echo "{$name} - {$pass} - {$email}<br>";
    }
    $stmt->close();
} else {
    print_r($db->errorInfo()); 
}

Key changes are checking if $stmt is set before any parameters do anything. You also don't need store_result() or free_result(). Also, I added an else statement that should display an error if $stmt was not able to be set.

Note: You should use PHP's built-in functions (password_hash() and password_verify()) to handle password security. If you're using a PHP version less than 5.5 you can use the password_hash() compatibility pack. It is not necessary to escape passwords or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding.