PHP error with prepared statements using OOP

Question

I have recently followed a tutorial playlist on PHP OOP by mmtuts on youtube, but he used PDO and I don't and I am getting an error when I try to implement the code in my project.

My code:

//In file with class 'Article'.
public function deleteArticle($id) {
     $conn = $this->connect();
     $sql = "UPDATE article SET deleted=1 WHERE row_id=?";
     $stmt = $conn->prepare($sql);
     $stmt->bind_param("i", $id);
     $stmt->execute();
     $result = $stmt->get_result();
     return $result;
}

//In file with class 'DBConn'.
public function connect() {
   $conn = new mysqli('localhost', 'root', '','nicms');
   if ($conn->connect_error) {
      die("Connection failed: " . $conn->connect_error);
   }
   return $conn;
}

//In file with class 'articleContr'.
public function showDeleteArticle($id) {
   if ($this->deleteArticle($id)
       echo "Article has successfully been deleted.";
   else 
     echo "Failed to delete article.";
}

The error is that the article DOES get deleted but the method showDeleteArticle gives the message 'Failed to delete article'. even though the article has been deleted.

The PHP documentation says get_result only returns values for SELECT queries and false for all other query types. Have you read the documentation for examples of what to do when you're doing INSERT/UPDATE/DELETE queries?https://www.php.net/manual/en/mysqli-stmt.get-result.php — GordonM, Jun 12 '20 at 09:02
You need to stop manually checking for errors. Please read: [Should we ever check for mysqli_connect() errors manually?](https://stackoverflow.com/q/58808332/1839439) and [Should I manually check for errors when calling “mysqli_stmt_prepare”?](https://stackoverflow.com/q/62216426/1839439) — Dharman, Jun 12 '20 at 11:23

score 0 · Accepted Answer · answered Jun 12 '20 at 12:02

This code is wrong on so many levels (as you would expect from a youtube tutorial), but the main problem is that the method showDeleteArticle() is wrong and misleading.

There is no reason for this method to be at all. Which is proven by the fact the other answer is accepted. The offered code always returns a true-like value, hence the condition inside showDeleteArticle() becomes useless. One could rewrite it as

public function showDeleteArticle($id) {
    echo "Article has successfully been deleted.";
}

as it will never enter the else part anyway.

Let alone any Controller should never blurt out any data directly, not through View. Least after a POST request after which there must be a redirect, not output.

I understand what you mean but how should I check if the sql statement succeeded or not? — , Jun 13 '20 at 19:05
Not at all. Please see my answer that explains it: https://codereview.stackexchange.com/a/243749/101565 — Your Common Sense, Jun 13 '20 at 19:07

score -2 · Answer 2 · answered Jun 12 '20 at 09:01

the error is that you return a $result, this will only work when using a select statement. But on an insert, update, delete there is no need for the $result, the $result is NOT a boolean and that is why it does not work in the if statement. You should return the $stmt because and check that in the if statement

Change your code to this and it should work:

    protected function unSetArticle($id) {
        $conn = $this->connect();
        $sql = "UPDATE article SET deleted=1 WHERE row_id=?";
        $stmt = $conn->prepare($sql);
        $stmt->bind_param("i", $id);
        $stmt->execute();
        return $stmt;
    }//Method unSetArticle.

this code is essentially useless. Just like the other variant that always returned false, this one always returns true, which is not an improvement whatsoever. — Your Common Sense, Jun 12 '20 at 12:03

PHP error with prepared statements using OOP

2 Answers2