-4

I want to do an update function in php mvc of my "destinations" but I have this error that I don't understand, yet my model seems correct? Can someone unblock me? It's my debut in php be indulgent lol

The error : "

Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens in C:\xampp\htdocs\Imaluu\model\update_destination.php on line 15 "

Here is my code :

Model

<?php 
include '../inc/init.inc.php'; // initialisation du site

function update_destination($titre, $img1, $img2, $img3, $description1, $description2, $map) {
    global $pdo;
    $id = $_GET['id_destination'];
    $enregistrement= $pdo->query(
            "UPDATE destination 
                SET titre='$titre', img1='$img1', img2='$img2', 
                    img3='$img3', description1='$description1', 
                    description2='$description2', map='$map' 
              WHERE 'id_destination'=$id");

    $enregistrement->bindParam(':titre', $titre, PDO::PARAM_STR);
    $enregistrement->bindParam(':img1', $img1, PDO::PARAM_STR);
    $enregistrement->bindParam(':img2', $img2, PDO::PARAM_STR);
    $enregistrement->bindParam(':img3', $img3, PDO::PARAM_STR);
    $enregistrement->bindParam(':description1', $description1, PDO::PARAM_STR);
    $enregistrement->bindParam(':description2', $description2, PDO::PARAM_STR);
    $enregistrement->bindParam(':map', $map, PDO::PARAM_STR);
    $enregistrement->execute();
}

function get_modif() {
    global $pdo;
    $id = $_GET['id_destination'];
    $destination_modif = $pdo->query(
            "SELECT d.id_destination, titre, img1, img2, img3, description1, 
                    description2, continent_destination, map 
            FROM destination d, 
                 continent_destination c, 
                 relation_continent_destination r 
            WHERE c.id_continent = r.id_continent 
            AND d.id_destination = r.id_destination 
            AND d.id_destination = $id");
    return $destination_modif->fetchAll(PDO::FETCH_ASSOC);
}

Controller :

include '../model/update_destination.php';

if(!empty($_GET['id_destination'])) {
    if( isset($_POST['titre']) && isset($_POST['img1']) && isset($_POST['img2']) && isset($_POST['img3']) && isset($_POST['description1']) && isset($_POST['description2']) && isset($_POST['id_continent']) && isset($_POST['map']) ) {
        $id = $_GET['id_destination'];
        $titre = trim($_POST['titre']);
        $img1 = trim($_POST['img1']);
        $img2 = trim($_POST['img2']);
        $img3 = trim($_POST['img3']);
        $description1 = trim($_POST['description1']);
        $description2 = trim($_POST['description2']);
        $id_continent = trim($_POST['id_continent']);
        $map = trim($_POST['map']);
        
        update_destination($titre, $img1, $img2, $img3, $description1, $description2, $map);
    }
    $modifie = get_modif();
}
Dharman
  • 30,962
  • 25
  • 85
  • 135
Mahylan
  • 1
  • 1
  • 2
    You're using prepared statements wrong. https://www.php.net/manual/en/pdo.prepare.php You need to replace all variables you're injecting into the query with placeholders. – M. Eriksson Aug 21 '23 at 22:24
  • 2
    Bad habits [you should learn to break A.S.A.P](https://sqlblog.org/2009/10/08/bad-habits-to-kick-using-old-style-joins) It's `YEAR(CURDATE())`, the **ANSI-92** explicit JOIN syntax has been around for `(YEAR(CURDATE() - 1992) as A_Very_Long_Time`, it's long past time you adopted it's use. Bad Habits to Kick : [Using old-style JOINs](https://sqlblog.org/2009/10/08/bad-habits-to-kick-using-old-style-joins) – RiggsFolly Aug 21 '23 at 22:30
  • _Please_ look more closely and carefully at examples of the usage of prepared statements and parameters, it's not a secret and it's not complicated. And...was there something confusing about the error message? Did you google it? There are plenty of existing pages online explaining what it means and how to solve it. Again, if you'd studied prepared statements more carefully, you'd understand that you have to provide a placeholder for each parameter, not just expect the parameters to somehow bind to something in the SQL statement as if by magic. It's simple string matching to placeholders! – ADyson Aug 21 '23 at 22:41

0 Answers0