Dynamic prepared statement, PHP

Question

I've checked almost all questions that produce the same error but all of these questions bind parameters in some wrong way. Perhaps and most probably I too am binding params incorrectly though my case is different because I've dynamic query.

I am creating query dynamically from input which is being created perfectly. But problem comes from $stmt->bind_param statement within foreach loop. Here is my Code snippet that is erronous:

$query = "UPDATE users SET";
        foreach($updationFields as $field => $value){
            if($value != "-"){
                $query = $query. " " . $field . " = :".$field.",";
            }
        }
        $query = rtrim($query, ",");
        $query = $query . " WHERE UserId = :UserId";

        $stmt = $this->conn->prepare($query);
        foreach($updationFields as $field => $value){
            echo $field;
            if($value != "-"){
                $input = ":".$field;
                $stmt->bind_param($input, $value); // This line produces error
            }
        }
        $stmt->bind_param(":UserId", $userId);

        $stmt->execute();      

Here is produced dynamic "string query" for one field:

UPDATE users SET fullName = :fullName WHERE UserId = :UserId

Error says: Fatal error: Call to a member function bind_param() on a non-object in

Any Idea what i am doing wrong?

Answer 1

As pointed out by @Fred-ii- and @commorrissey :Placeholder is supported by PDO not mysqli so so I had to:

1. Replace :Placeholders with ?
2. Call bind_param with call_user_func_array feeding dynamic references as expected by mysqli_stmt.

Here is the code that creates dynamic binding:

            $params = array();//
            $params[] = $type;
            $i=0;
            foreach($updationFields as $field => $value){
                if($value != "-"){
                    $bind_name = 'bind' . $i;
                    $$bind_name = $value;
                    $params[] = &$$bind_name;
                    $i++;
                }
            }
            $bind_name = 'bind' . $i;
            $$bind_name = $userId;
            $params[] = &$$bind_name;

            $return = call_user_func_array(array($stmt,'bind_param'), $params);