PDO update database

Question

Hi I'm new to PHP and PDO. I am trying to update a record in my database depending on the login_id variable that I have declared in my sessions file (my session are working fine).

I have the following code for the update script. It is throwing up an errors with the execute statement.

"Uncaught exception 'PDOException' with message 'SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens' in /home/atlismap/public_html/bio.php:40 Stack trace: #0 /home/atlismap/public_html/bio.php(40): PDOStatement->execute() #1 {main}"

Does anybody know why?

require_once 'check.php';
$sql = "UPDATE users SET username = :username, 
        full_name = :full_name, 
        country = :country,   
        bio = :bio  
        WHERE id = : $log_user_id";
$stmt = $dtb->prepare($sql);                                  
$stmt->bindParam(':full_name', $_POST['full_name'], PDO::PARAM_STR);          
$stmt->bindParam(':country', $_POST['country'], PDO::PARAM_STR);
$stmt->bindParam(':bio', $_POST['bio'], PDO::PARAM_STR);   
$stmt->execute(); 

Answer 1

You have to set ':username' like other params:

$stmt->bindParam(':username', $_POST['username'], PDO::PARAM_STR); 

And fix:

$sql = "UPDATE users SET
…
WHERE id = : $log_user_id";

by:

$sql = "UPDATE users SET 
…
WHERE id = :id";
$stmt->bindParam(':id', $log_user_id, PDO::PARAM_INT); 

PDO permits to bind param with ":param_name" but you use a variable for you id so you can use the param ":id" and bind it, or use "WHERE id=$variable.

Answer 2

There are two problems I see.

You don't have a variable binded to :username and there is a problem that lies at WHERE id = : $log_user_id";

You should either remove the : and just use '$log_user_id' (if this is safe) or use :log_user_id and bind it below.

Another way to do this is just to bind them in execute which I just found easy and less code to write:

$sql = "UPDATE users SET username = ?, 
        full_name = ?, 
        country = ?,   
        bio = ?  
        WHERE id = ?";
$stmt = $dtb->prepare($sql);                                   
$stmt->execute(array($_POST['username'], $_POST['full_name'], $_POST['country'], $_POST['bio'], $log_user_id));

Just bind them in the order in which you put the ?'s in the query