Converting mysqli insert into prepared statements

Beginners - Learning PHP
#1 
//add user to the table
$salt = "\$5\$rounds=5000\$" . "gillinghamforprem" . $username . "\$";
$hash = crypt($password, $salt);

   // $insertuserquery = $mysqli->("INSERT INTO Users (username, hash, salt) VALUES ('". $username . " ', '" . $hash . "', '" . $salt . "');");
$insertuserquery = $mysqli->("INSERT INTO Users (username, hash, salt) VALUES (?,?,?)");
$insertuserquery->bind_param("sss", '". $username . " ', '" . $hash . "', '" . $salt . "');
$insertuserquery->execute();

mysqli_query($con, $insertuserquery) or die("4: Insert user query failed"); // error #4 - insert queryfailed

echo("0");

Hi i am getting a parse error, i am learning to convert code to prepared statements and struggling with this insert section.

any help would be helpful.

#2

What does the error say? I can probably guess, but it’s easier for people to help you if you give all the details of the problem.

#3

The correct syntax to call an object’s method is -

$returned_value = $some_object->method_name();

Where are you calling mysqli’s ->prepare() method? Also, why are you still calling mysqli_query(). The functional-point of a prepared query is you are replacing the query() call with the statements needed for a prepared query - prepare(), bind_param(), and execute().

#4

Parse error: syntax error, unexpected '(', expecting identifier (T_STRING) or variable (T_VARIABLE) or '{' or '$' in /home/sites/5a/8/83a6433687/public_html/SalesTrackerV1/register.php on line 40

(line 40) $insertuserquery = $mysqli->(“INSERT INTO Users (username, hash, salt) VALUES (?,?,?)”);

Im creating a program via unity to keep sales data for work. I had it working but was not prepared statements so trying to secure it more.

#5

changed code as i spotted where I was possibly making a mistake and have a new error.

//add user to the table

    $salt = "\$5\$rounds=5000\$" . "gillinghamforprem" . $username . "\$";

    $hash = crypt($password, $salt);

    

   // $insertuserquery = $mysqli->("INSERT INTO Users (username, hash, salt) VALUES ('". $username . " ', '" . $hash . "', '" . $salt . "');");

    $insertuserquery ="INSERT INTO Users (username, hash, salt) VALUES (?,?,?)";

    $insertResult = $con->prepare($insertuserquery);

    $insertResult->bind_param("sss", '". $username . " ', '" . $hash . "', '" . $salt . "');

    $insertResult->execute();
 //mysqli_query($con, $insertuserquery) or die("4: Insert user query failed"); // error #4 - insert queryfailed

    echo("0");

ERROR


Fatal error: Uncaught Error: Cannot pass parameter 2 by reference in /home/sites/5a/8/83a6433687/public_html/SalesTrackerV1/register.php:42 Stack trace: #0 {main} thrown in /home/sites/5a/8/83a6433687/public_html/SalesTrackerV1/register.php on line 42
#6

Thank you I have corrected all mistakes and now working as expected

//add user to the table

    $salt = "\$5\$rounds=5000\$" . "gillinghamforprem" . $username . "\$";

    $hash = crypt($password, $salt);

       

    $insertuserquery ="INSERT INTO Users (username, hash, salt) VALUES (?,?,?)";

    $insertResult = $con->prepare($insertuserquery);

    

    $insertResult->bind_param("sss", $username,  $hash, $salt);

    $insertResult->execute();
Sponsor our Newsletter | Privacy Policy | Terms of Service