0

    $userid = $_SESSION['userid'];
    $usern = $_SESSION['username'];
    $userrank = $_SESSION['rank'];


    $pdo = new PDO('mysql:host=localhost;dbname=localdb', 'root', '');

    if(isset($_GET['adda'])) {
    $error=false;
    $title=$_POST['title'];
    $lnk=$_POST['lnk'];
    $descr=$_POST['descr'];
    $alat=$_POST['alat'];
    $alng=$_POST['alng'];

     $statement = $pdo->prepare("INSERT INTO activity('title', 'link', 'description', 'alat', 'alng', 'fromname', 'fromid') VALUES (:title, :lnk, :descr, :alat, :alng, :usern, :userid) ");
     $result = $statement->execute(array('title' => $title, 'link' => $lnk, 'description' => $descr, 'alat' => $alat, 'alng' => $alng, 'fromname' => $usern, 'fromid' => $userid));

    }

The 

$statement
works fine in my register.php but here it doesnt work!

I get this error message: 

PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: parameter was not defined in C:\xampp\htdocs\activity.php on line 12

I cant find the mistake. Thanks for youre help! :)

Sentry
  • 81
  • 9
  • in activity.php whats on line 12? – Mees Kluivers Jan 13 '17 at 17:43
  • **WARNING**: When using PDO you should be using [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php) with placeholder values and supply any user data as separate arguments. In this code you have potentially severe [SQL injection bugs](http://bobby-tables.com/). Never use string interpolation or concatenation and instead use [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php) and never put `$_POST` or `$_GET` data directly in your query. Refer to [PHP The Right Way](http://www.phptherightway.com/) for guidance with this and other problems. – tadman Jan 13 '17 at 18:05

0 Answers0