-2

I'm using MySQLiIn the WHERE clause of my statement I am adding parameters on RHS:

Prepared statement:

$sql = 'select * from emailstobeverified where email=email_input and verification_code=code_input;';

And then I use $stmt->prepare($sql);

And I get a PHP error saying:

Sql Error: Unknown column 'email_input' in 'where clause'

(I thought that the LHS of the boolean expression counts as the column? )

the below query will work:

$sql = 'insert into emailstobeverified (email) values (:email);';

Here, I can use :email as a parameter, so I tried making email_input have a colon before it: :email_input and used that as the param. However I got a syntax error:

Sql Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ':email_input and verification_code=:code_input' at line 1

What's the correct syntax for comparing the table column value to some param?

Andrew Kor
  • 579
  • 7
  • 19
  • you are trying to mix PDO and mysqi syntax here. Just keep to the same syntax. there is **no difference** in the prepared statement syntax. just use the same syntax for select that you used (and which really worked) for insert. – Your Common Sense May 01 '19 at 07:01

1 Answers1

1

Your syntax is off, and email_input should instead be a positional parameter:

$sql = "SELECT * FROM emailstobeverified WHERE email = ? and verification_code = ?";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param("si", $email_input, $code);
$stmt->execute();
Tim Biegeleisen
  • 502,043
  • 27
  • 286
  • 360