我的mysqli代码出了什么问题？

Question

I am trying to embed mysqli code into my web page so I can eliminate sql injection. Here is what my code looks like right now:

$gYear = $_POST["year"];
$gYear2 = $_POST["year2"];
$gMonth = $_POST["month"];
$gSelect = $_POST["location"];

$query = $conn->prepare("SELECT $gSelect, Year FROM unemployed WHERE year BETWEEN '$gYear' AND '$gYear2' and month='$gMonth'");
$query->bind_param('ssss', $gyear, $gYear2, $gMonth, $gSelect);

$query->execute(); 
$result = $query->get_result();

while ($row = $result->fetch_object()){


// do something with gathered rows 
}

Now, once the form is submitted, I get two errors. Here is what they say:

Warning: mysqli_stmt::bind_param() [mysqli-stmt.bind-param]: Number of variables doesn't match number of parameters in prepared statement in

AND

Fatal error: Call to undefined method mysqli_stmt::get_result() in

I really don't know what my issue is. I tried to follow the rules listed in How can I prevent SQL injection in PHP? . Does anyone know what my issues are? Why am I receiving these two error messages? Any help would be greatly appreciated.

Answer 1

For mysqli::prepare() , you must use ? for parameters. (The code in the post uses standard PHP variable substitution into the string - this should not be done for values when using placeholders.)

I'd strongly advise against letting users choose the column that you're selecting. Use a switch() or something similar to choose the column name in code, and place it in the $column variable.

switch($_POST['location']){
  case "loc1":
    $column = "location_one";
    break;
  case "loc2":
    $column = "location_two";
    break;
  // etc, etc...
}
$query = $conn->prepare("SELECT $column, year FROM unemployed WHERE year BETWEEN ? AND ? and month=?");
$query->bind_param('sss', $gyear, $gYear2, $gMonth);

Answer 2

You Can use PDO to prevent sql injection and it is also work for >= PHP 5.1

PDO and the PDO_SQLITE driver is enabled by default as of PHP 5.1.0. You may need to
enable the PDO driver for your database of choice;consult the documentation for 
database-specific PDO drivers to find out more about that.

PDO documentation

It is most widely used and if you know how to use mysqli then is it also easy for you

Tutorial from tutsplus

Why you Should be using PHP's PDO for Database Access