为什么我在尝试插入数据库时​​遇到准备语句错误

Question

我得到以下错误，当我尝试使用php将表单中的数据插入数据库时​​。有人可以让我知道为什么会这样吗？

Warning: mysqli::query() expects parameter 1 to be string, object given in C:\xampp\htdocs\westend\process.php on line 25

Catchable fatal error: Object of class mysqli_stmt could not be converted to string in C:\xampp\htdocs\westend\process.php on line 28

这是我的代码

<?php
session_start();
 if (isset($_POST['sub'])) {
$host='localhost';
$user='root';
$pass='';
$db='theatre_booking';

$con=mysqli_connect($host,$user,$pass,$db);

$row= mysqli_real_escape_string($con, $_SESSION['row']);
$zone= mysqli_real_escape_string($con, $_SESSION['zone']);
$quantity= mysqli_real_escape_string($con, $_SESSION['qty']);
$quote= mysqli_real_escape_string($con, $_SESSION['quotation']);

$sql=$con->prepare( "INSERT INTO booking(PerfDate, PerfTime, Name, Email, Zone, RowNumber) 
VALUES (
    '{$_SESSION['date']}',
    '{$_SESSION['time']}',
    '{$_SESSION['name']}',
    '{$_SESSION['email']}',
    '{$_SESSION['zone']}',
    '{$_SESSION['row']}')");

    if ($con->query($sql) === TRUE) {
    echo "Booking successful";
} else {
    echo "Error: " . $sql . "<br>" . $con->error;
    }

}


?>

Answer 1

$con＆gt; prepare（）函数不返回带有SQL的字符串，但它返回mysqli_stmt对象。所以如果你想使用它，你可以这样做：

$stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?");
$stmt->bind_param("date", $_SESSION['date']);
$stmt->bind_param("date2", $_SESSION['date2']);
$stmt->bind_param("date3", $_SESSION['date3']);
//.......
$stmt->execute();

如果你想使用查询：$ con＆gt; query（$ sql）;那么$ sql应该是一个等于的SQL字符串：

$sql = "INSERT INTO booking(PerfDate, PerfTime, Name, Email, Zone, RowNumber) 
VALUES (
    '{$_SESSION['date']}',
    '{$_SESSION['time']}',
    '{$_SESSION['name']}',
    '{$_SESSION['email']}',
    '{$_SESSION['zone']}',
    '{$_SESSION['row']}')";