如何在bind_param上使用implode？

Question

So I have a create account method and within that an associative array called userInfo . This is the array:

$userInfo = array(
        'username' => $username,
        'salt'     => $this->passwordHash('Extra Protection is a good thing'),
        'password' => $this->passwordHash($password)
    );

Now I am "Trying" to use implode with the prepared statement. I seem to be getting a No data supplied for parameters in prepared statement error when it attempts to bind the parameters.

Here is the statement:

if ( ! ($stmt = $this->Connection()->prepare("INSERT INTO " . $this->_info['Prefix'] . "users
    (`".implode("`, `", array_keys($userInfo))."`) VALUES (?, ?, ?)")))
    {
        echo 'Prepare Failed: ' . $stmt->error . '<br />';
    }

    if ( ! $stmt->bind_param('sss', implode("', '", $userInfo)))
    {
        echo 'Bind Failed: ' . $stmt->error . '<br />';
    }

    if ( ! $stmt->execute())
    {
        echo 'Execute Failed: ' . $stmt->error . '<br />';
    }

I originally used real_escape_string and the query did execute correctly. It's just the prepared statement that it doesn't like.

What is wrong with it?

Answer 1

You don't properly understand prepared statements. Each inserted value would be prepared according to it's table field definintion. This is your query for example:

INSERT 
    INTO users (`username`, `salt`, `password`) 
    VALUES ('john', 'somesalt', 'somepassword');

So value jonh will be prepared according to username field settings, somesalt - according to salt , etc.

So what are your errors here (i skip implode and etc):

When you do:

$stmt = $this->Connection()->prepare("INSERT INTO " 
    . $this->_info['Prefix']
    . "users  (`user`, `salt`, `password`) values (?, ?, ?)");
$stmt->bind_param('sss', implode("', '", $userInfo))

it's wrong because query expects 3 string ( s ), each string will be prepared according to field settings, and you're giving only one.

When you change to this:

 $stmt = $this->Connection()->prepare("INSERT INTO " 
    . $this->_info['Prefix']
    . "users  (`user`, `salt`, `password`) values (?)");
 $stmt->bind_param('s', implode("', '", $userInfo))

it's wrong too, because here comes query error. You want to insert three fields but give value for one field only.

So what you really should do is:

$stmt = $this->Connection()->prepare("INSERT INTO " 
    . $this->_info['Prefix']
    . "users  (`user`, `salt`, `password`) values (?, ?, ?)");
$stmt->bind_param('sss', $userInfo['username'], $userInfo['salt'], $userInfo['password']);

So, in the end it's impossible to use implode with bind_param in mysqli (I hope it's mysqli), and if you want to know hot to use bind_param with array of values - you should read this comment on php.net - http://ru2.php.net/manual/ru/mysqli-stmt.bind-param.php#104073