mysqli why does this happens?

Question

I have two subsequent mysqli statements, and the second returns:

Fatal error: Call to a member function bind_param() on a non-object in ...

Why this happens? Does this means that I need to open two different connection? Is there any way to avoid this (I love keeping the SQL connection details in one file)?

Here the code:

$db = new mysqli("localhost", "root", "", "database");

$stmt = $db->prepare("UPDATE posts SET vote_".$_POST['vote']." = vote_".$_POST['vote']." + 1 WHERE id=?");
$stmt->bind_param('s', $_POST['id_post']);
$stmt->execute();
$stmt->close();

$stmt = $db->prepare("INSERT INTO votes (kind, users_id, posts_id) VALUES (?, ?, ?)");
$stmt->bind_param('sss',$_POST['vote'],$_POST['id_user'],$_POST['id_post']);
$stmt->execute();
$stmt->close();

I thought that using mysqli would completely avoid sql injection? — 0plus1, Apr 07 '09 at 13:55
If using bound values/parameters, you're safe from SQL injection. But what prevents the user from sending the user id of somebody else? — Jaka Jančar, Apr 07 '09 at 14:17
Several checks that happens way before those queries that are terminated with die() — 0plus1, Apr 07 '09 at 14:22
@0plus1: It's important to note that it's not MySQLi that protects you from SQL injection (it's very easy to use MySQLi and still be vulnerable!), but the _prepared statements_. — Lightness Races in Orbit, Aug 14 '11 at 17:34

score 1 · Answer 1 · answered Apr 07 '09 at 13:28

1

I think your $stmt variable is null when you call bind_param over it. maybe your $_POST['vote'] is empty? you can check it before you bind the param on the command

answered Apr 07 '09 at 13:28

Jhonny D. Cano -Leftware-

17,663
14
81
103

score 1 · Accepted Answer · answered Apr 07 '09 at 13:33

1

Check the return value of mysqli::prepare. If it is FALSE, you should get the details for the occured error with mysqli::error.

answered Apr 07 '09 at 13:33

joschi

12,746
4
44
50

score 0 · Answer 3 · answered Apr 07 '09 at 13:30

0

Something might have gone wrong with $db->prepare(), check $db->error.

answered Apr 07 '09 at 13:30

Jaka Jančar

11,386
9
53
74

That was the problem, I named differently one of the fields.. shame on me for not checking the error.. I thought that was a problem of making two consecutive queries.. thanks! – 0plus1 Apr 07 '09 at 13:52

mysqli why does this happens?

3 Answers3

Linked