PHP bind_param致命错误

Question

在这里需要一些帮助，当我尝试绑定时，这是一个致命的错误。

  

在非对象上调用成员函数bind_param（）。

请帮助:(

<?php
$connection = mysqli_connect("localhost","root","","shopp"); //connect to database
if (!$connection){
    die('Could not connect: ' . mysqli_connect_errno()); //return error is connect fail
}

$query= $connection->prepare("select * from login where (USERNAME=?,PASSWORD=?");

$username=$_POST['uname'];
$password=$_POST['pass'];

 $query ->bind_param('ss',$password,$username);

// To protect MySQL injection for Security purpose
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$rows = mysql_num_rows($query);
if ($rows == 1) {
$_SESSION['login_user']=$username; // Initializing Session
header("location: web.html"); // Redirecting To Other Page
} else {
header("location: loginerror.html");
}

?>

错误就在这一行：

$query ->bind_param('ss',$password,$username);