Call to a member function bind_param() on boolean, function prepare() returns false when using placeholders

Question

I try to prepare statement to sql (mysqli) in php, but there is an error code as written above. This is the code I wrote:

 if (!$this->isUserExist($username, $token)) {return false;}
    $tables = array();        
    $tables[0] = "faculty";     
    $tables[1] = "department";  
    $tables[2] = "teacher";     
    $tables[3] = "announcement";
    $ttable = $tables[$table];
    var_dump($ttable); // faculty
    var_dump($id);     // 6
    echo "DELETE FROM ".$ttable." WHERE ".$ttable.".id = ".$id.""; //returns DELETE FROM faculty WHERE faculty.id = 6
    $stmt = $this->con->prepare("DELETE FROM ? WHERE ?.id = ?"); //Fatal error occurs here
    $stmt->bind_param("sss",$ttable,$ttable,$id);
    //$stmt->execute();
    if ($stmt->num_rows> 0) {
        return "true";
    } else {
        return "false";
    }

However if i insert exact statement without any placeholders that is shown in echo my i get no errors, and MySQL database successfully deletes row.

$stmt = $this->con->prepare("DELETE FROM faculty WHERE faculty.id = 6"); //no errors occur, executing this statement does affect row in MySQL database

What is right way to assign both table names and column names? — user3460802, Jun 13 '17 at 07:24

score 1 · Accepted Answer · answered Jun 13 '17 at 07:13

1

The system doesn't allow to 'prepare' table names, You should do it this way

$stmt = $this->con->prepare("DELETE FROM ".$ttable." WHERE ".$ttable.".id = ?"); //Fatal error occurs here
$stmt->bind_param("s",$id);

answered Jun 13 '17 at 07:13

nacho

5,280
2
25
34

After modifiation of my code according to your answer, everything worked. Thank you for your quick reply! – user3460802 Jun 13 '17 at 07:20
@user3460802 If you liked my answer and did help you, could you vote it? – nacho Jun 13 '17 at 07:23
I voted up your answer, but since i have less than 15 reputation it isn't shown publicly – user3460802 Jun 13 '17 at 07:28
When for example `$ttable = " faculty --"`, you can say goodbye to all of your recrds. – u_mulder Jun 13 '17 at 07:55

score 0 · Answer 2 · answered Jun 13 '17 at 07:15

0

please read this http://us3.php.net/manual/en/book.pdo.php#69304

Table and Column names cannot be replaced by parameters in PDO.

Do something like this:

$query =  "DELETE FROM ".$ttable." WHERE ".$ttable.".id = ?";
$stmt = $this->con->prepare($query);
$stmt->bind_param("s",$id);

answered Jun 13 '17 at 07:15

Ahmed Ginani

6,522
2
15
33

Thank you for your reply. I applied changes that you suggested and function works properly. – user3460802 Jun 13 '17 at 07:26
@user3460802 welcome – Ahmed Ginani Jun 13 '17 at 07:30

Call to a member function bind_param() on boolean, function prepare() returns false when using placeholders

2 Answers2