Prepared statement error in PHP

Question

I have the following SQL query that is executed using PHP, $q is a variable with a string in it.

$sql =$conn->prepare('SELECT * FROM namebase WHERE name LIKE "%?%"');
$sql->bind_param('s', $q);
$sql->execute();

While executing, I receive an error message saying,

Warning: mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters in prepared statement in C:\xampp\htdocs\file\s.php on line 39

Line 39 is $sql->bind_param('s', $q);

What is causing this error? I am only passing one variable to the query. Then why is it showing this error message?

Answer 1

Take a look at the comments on the documentation page for the mysqli_stmt::bind_param method, someone has come across exactly the same problem: https://secure.php.net/manual/en/mysqli-stmt.bind-param.php#102048

I had a problem with the LIKE operator

This code did not work:

 <?php $test = $sql->prepare("SELECT name FROM names WHERE name LIKE %?%"); $test->bind_param("s", $myname); ?> 

The solution is:

 <?php $test = $sql->prepare("SELECT name FROM names WHERE name LIKE ?"); $param = "%" . $myname . "%"; $test->bind_param("s", $param); ?> 

Answer 2

If you have access to the database I would suggest creating a Stored Procedure.

And then create as follows:

getNames(
    IN nameVAR VARCHAR(256)
)

SELECT * FROM namebase WHERE name LIKE ‘%nameVAR%’;

Then in your php call getName(?) instead of putting your current statement