bind_param 不会替换我准备好的语句中的 ?s

Question

It registers the user successfully. But when I check it on my database, all of the values are 0s. What's the problem?

here's the function code:

public function insertUser($email, $firstName, $lastName, $encryptedPassword, $salt)
{
    //SQL language - command to insert data
    $sql = "INSERT INTO users (email, firstName, lastName, password, salt) VALUES (email=?, firstName=?, lastName=?, password=?, salt=?)";

    //preparing SQL for execution by checking the validity
    $statement = $this->conn->prepare($sql);

    //if error
    if (!$statement)
    {
        throw new Exception(($statement->error));
    }

    //assigning variables instead of '?', after checking the preparation and validity of the SQL command
    $statement->bind_param('sssss', $email, $firstName, $lastName, $encryptedPassword, $salt);

    //result will store the status/result of the execution of SQL command
    $result = $statement->execute();

    return $result;
}

The parameters for the function get set with the correct values when called, I tested it

I'm pretty new to PHP. If i correct my function, it doesn't create a new user. It doesn't even print out anything in the browser window. Here's the piece of code that calls this one (maybe it helps you with finding the solution):

$result = $access->insertUser($email, $firstName, $lastName, $encryptedPassword, $salt);

//result is positive
if ($result)
{
    //throw back the user details
    $return['status'] = '200';
    $return['message'] = 'Successfully registered';
    $return['email'] = $email;
    $return['firstName'] = $firstName;
    $return['lastName'] = $lastName;

    echo json_encode($return);

    $access->disconnect();
}

Answer 1

Your query is wrong.

                           //columns are declared here
$sql = "INSERT INTO users (email, firstName, lastName, password, salt) VALUES (email=?, firstName=?, lastName=?, password=?, salt=?)";
                                                                              //you do not need to declare your columns again

Simple change your query to

$sql = "INSERT INTO users (email, firstName, lastName, password, salt) VALUES (?, ?, ?, ?, ?)";

Also, it appears as though you are storing your password and the salt separately, that tells me you are rolling your own hashing algorithm, there isn't really a need for this. I would remove your salt column, and use password_hash() for your password column.

Answer 2

remove the column=?

$sql = "INSERT INTO users (email, firstName, lastName, password, salt) VALUES (?, ?, ?, ?, ?)";

the code

column=?    

in your value assignment is evalued as boolean condition that return false (0)