mysqli_stmt :: bind_param():类型定义字符串中的元素数与绑定变量数不匹配,无法选择

时间:2017-12-12 20:44:07

标签: php mysqli prepared-statement code-injection

我有一个问题我不能做选择抛出以下错误:

  

警告:mysqli_stmt :: bind_result():绑定变量数与第19行的Login.php中预准备语句中的字段数不匹配

此代码:

$user = "user";
$pass = "pass";

$conn = new mysqli(MYSQL_HOST, MYSQL_USER,MYSQL_PASS,MYSQL_DB);

$sql = "SELECT * FROM users where pass = ? and user = ?" ;

$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $user, $pass);

$stmt->execute();
$stmt->bind_result($userLogin);
$stmt->fetch();

echo $userLogin;

这是MySQL中的表

id  int(11) NO  PRI     auto_increment
user    varchar(45) NO  UNI     
pass    varchar(45) NO          

我不明白为什么错误

帮助

谢谢

1 个答案:

答案 0 :(得分:0)

bind_result所有个选定字段绑定到变量。这意味着如果您从表格中选择3个字段,则必须提供3个变量:

$sql = "SELECT * FROM users where pass = ? and user = ?" ;

$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $user, $pass);

$stmt->execute();
// here - three fields are binded to three variables
$stmt->bind_result($userId, $userLogin, $userPass);
$stmt->fetch();

或仅选择必需字段:

$sql = "SELECT user FROM users where pass = ? and user = ?" ;

$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $user, $pass);

$stmt->execute();
// here - one field is binded to one variable
$stmt->bind_result($userLogin);
$stmt->fetch();

最后,您混合了bind_param变量的顺序:

$sql = "SELECT user FROM users where pass = ? and user = ?" ;
$stmt->bind_param("ss", $pass, $user); // first - pass, second - user