Invalid parameter number - PDO error

Question

Please do not castigate me for asking a question that has been asked many times. I have spent hours ploughing through answers but cannot find a solution to mine. I am just learning to use PDO. I have successfully used it to select from a database and display results but I am having a problem with the Update function.

I get the error: SQLSTATE[HY093]: Invalid parameter number: parameter was not defined.

I have checked and rechecked my code but no typos spring out at me, so maybe it has something to do with the edit_date field? If anyone can help me I would be extremely grateful as I have spent hours researching and experimenting with no solution. Regards Tog.

here is the code:

  $article_id = (trim ( $_POST [ 'id' ]) == ' ') ? die ( 'ERROR:no ID' ) : mysql_escape_string ( $_POST [ 'id' ] );
    $article_id = (INT) $article_id;
    $title = (trim ( $_POST [ 'title' ]) == ' ') ? die ( 'ERROR: Enter a Title' ) : mysql_escape_string ( $_POST [ 'title' ] );
            $author = (trim ( $_POST [ 'author' ]) == ' ') ? die ( 'ERROR: Enter an Author name' ) : mysql_escape_string ( $_POST [ 'author' ] );
            $image_url = (trim ( $_POST [ 'image_url' ]) == ' ') ? die ( 'ERROR: Enter an Image URL' ) : mysql_escape_string ( $_POST [ 'image_url' ] );
            $main_article = (trim ( $_POST [ 'main_article' ]) == ' ') ? die ( 'ERROR: Enter some article content' ) : mysql_escape_string ( $_POST [ 'main_article' ] );
            $snippet = (trim ( $_POST [ 'snippet' ]) == ' ') ? die ( 'ERROR: Enter snippet text' ) : mysql_escape_string ( $_POST [ 'snippet' ] );
            $friendly_url = (trim ( $_POST [ 'friendly_url' ]) == ' ') ? die ( 'ERROR: Enter a friendly url' ) : mysql_escape_string ( $_POST [ 'friendly_url' ] );
            $meta_title = (trim ( $_POST [ 'meta_title' ]) == ' ') ? die ( 'ERROR: Enter a Meta Title' ) : mysql_escape_string ( $_POST [ 'meta_title' ] );
            $meta_description = (trim ( $_POST [ 'meta_description' ]) == ' ') ? die ( 'ERROR: Enter a Meta Description' ) : mysql_escape_string ( $_POST [ 'meta_description' ] );
            $edited_by = (trim ( $_POST [ 'edited_by' ]) == ' ') ? die ( 'ERROR: who edited this?' ) : mysql_escape_string ( $_POST [ 'edited_by' ] );
            $edit_date = CURRENT_TIMESTAMP;

    try {
        $dbh = new PDO("mysql:host=$hostname;dbname=gosport", $username, $password);
        /*** echo a message saying we have connected ***/
        echo 'Connected to database<br />';
        $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        /*** Update data ***/
       $sql = "UPDATE sport SET title = :title, 
                author = :author, 
                image_url = :image_url,  
                main_article = :main_article,  
                snippet = :snippet,
                edit_date = :edit_date,
                friendly_url = :friendly_url,
                meta_title = :meta_title,
                meta_description = :meta_description,
                edited_by = : edited_by
                WHERE article_id = :article_id";
    $stmt = $dbh->prepare($sql);                                  
    $stmt->bindParam(':title', $title, PDO::PARAM_STR);       
    $stmt->bindParam(':author', $author, PDO::PARAM_STR);  
    $stmt->bindParam(':image_url', $image_url, PDO::PARAM_STR);  
    $stmt->bindParam(':main_article', $main_article, PDO::PARAM_STR);  
    $stmt->bindParam(':snippet', $snippet, PDO::PARAM_STR);  
    $stmt->bindParam(':edit_date', $edit_date, PDO::PARAM_STR);  
    $stmt->bindParam(':friendly_url', $friendly_url, PDO::PARAM_STR);  
    $stmt->bindParam(':meta_title', $meta_title, PDO::PARAM_STR);  
    $stmt->bindParam(':meta_description', $meta_description, PDO::PARAM_STR);  
    $stmt->bindParam(':edited_by', $edited_by, PDO::PARAM_STR);  

    $stmt->execute(); 
             /*** close the database connection ***/
        $dbh = null;
        }
    catch(PDOException $e)
        {
        echo $e->getMessage();
        }

Thanks for the replies. I have made some changes accordingly and no longer get an error message but when I run the code it does not update the database. Everything stays the same as it was before I run the code.

My new code:

$article_id = (trim ( $_POST [ 'id' ]) == ' ');
$article_id = (INT) $article_id;
$title = (trim ( $_POST [ 'title' ]) == ' ');
$author = (trim ( $_POST [ 'author' ]) == ' ');
 $image_url = (trim ( $_POST [ 'image_url' ]) == ' ');
$main_article = (trim ( $_POST [ 'main_article' ]) == ' ');
$snippet = (trim ( $_POST [ 'snippet' ]) == ' ');
$friendly_url = (trim ( $_POST [ 'friendly_url' ]) == ' ');
$meta_title = (trim ( $_POST [ 'meta_title' ]) == ' ');
$meta_description = (trim ( $_POST [ 'meta_description' ]) == ' ');
$edited_by = (trim ( $_POST [ 'edited_by' ]) == ' ');
$edit_date = CURRENT_TIMESTAMP;

try {
    $dbh = new PDO("mysql:host=$hostname;dbname=gosport", $username, $password);
    /*** echo a message saying we have connected ***/
    echo 'Connected to database<br />';
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    /*** Update data ***/
   $sql = "UPDATE sport SET title = :title, 
            author = :author, 
            image_url = :image_url,  
            main_article = :main_article,  
            snippet = :snippet,
            edit_date = :edit_date,
            friendly_url = :friendly_url,
            meta_title = :meta_title,
            meta_description = :meta_description,
            edited_by = :edited_by
            WHERE article_id = :article_id";
$stmt = $dbh->prepare($sql);  
$stmt->bindParam(':article_id', $article_id, PDO::PARAM_STR);                                       
$stmt->bindParam(':title', $title, PDO::PARAM_STR);       
$stmt->bindParam(':author', $author, PDO::PARAM_STR);  
$stmt->bindParam(':image_url', $image_url, PDO::PARAM_STR);  
$stmt->bindParam(':main_article', $main_article, PDO::PARAM_STR);  
$stmt->bindParam(':snippet', $snippet, PDO::PARAM_STR);  
$stmt->bindParam(':edit_date', $edit_date, PDO::PARAM_STR);  
$stmt->bindParam(':friendly_url', $friendly_url, PDO::PARAM_STR);  
$stmt->bindParam(':meta_title', $meta_title, PDO::PARAM_STR);  
$stmt->bindParam('meta_description', $meta_description, PDO::PARAM_STR);  
$stmt->bindParam(':edited_by', $edited_by, PDO::PARAM_STR);  

$stmt->execute(); 
         /*** close the database connection ***/
    $dbh = null;
    }
catch(PDOException $e)
   {
  echo $e->getMessage();
  }

Answer 1

You are missing a binding for :article_id in the WHERE clause. Thus you have a mismatching number of parameters between your prepared statement and the parameters passed upon execution.

Also as noted in comments above, don't use "escape_string" type functions. There are unnecessary with parametrized prepared statements and would, in fact, introduce unintended character escapes in the recorded data when you have cases where escape sequences would be encountered.

Also, here:

edited_by = : edited_by

You probably want to lose the space after the colon. I honestly don't know if this would cause an error or not, but it is at least poor form.