PHP Checking if something exists in database

Question

I'm making an iOS app that sends a username string to this PHP file and then the PHP file checks to see if their username exists in a database, in a table called "members". I got this code online and modified it a little to fit my needs. This is the code:

// Main method to redeem a code
function redeem() {

    // Check for required parameters
    if (isset($_POST["username"])) {

        // Put parameters into local variables
        $code = $_POST["username"];

        echo $code;

        // Look up code in database
        $user_id = 0;

        echo "userid";

        $stmt = $this->db->prepare('SELECT username FROM members WHERE username=', $code); 

        echo "dbprepare";

       $stmt->bind_param("is", $code);

        echo "bindparam";

        $stmt->execute();

        echo "execute";

        $stmt->bind_result($id, $code);

        echo "bindresult";

        while ($stmt->fetch()) {
            break;
        }
        $stmt->close();

The code is tripping up on bind_param, it only gets to echo "dbprepare". Am I doing something incorrectly? How do I check for the username?

None of us have any idea what bind_param or bind_result mean. What API / framework are you using? — Calvin Froedge
– Calvin Froedge, Commented Dec 25, 2011 at 1:50

Kashif Khan · Accepted Answer · 2011-12-25 01:50:24Z

3

try this code

   $stmt = $this->db->prepare('SELECT username FROM members WHERE username=?');  

    echo "dbprepare"; 

   $stmt->bind_param("s", $code);

answered Dec 25, 2011 at 1:50

Kashif Khan

2,66516 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mario · Accepted Answer · 2011-12-25 01:50:44Z

3

I would guess you do miss an actual placeholder here:

$stmt = $this->db->prepare('SELECT username FROM members WHERE username=?', $code);

See the added ?. The prepare call does not just append the value. You do need to tell it where it belongs. (If your class implements prepare/bind as in mysqli or PDO, and as commonly understood.)

answered Dec 25, 2011 at 1:50

mario

146k20 gold badges243 silver badges293 bronze badges

1 Comment

mario Over a year ago

See also what Kashif wrote. If it's really mysqli, then you pass the variable separately, and with maybe just 's' as type specifier.

Lion · Accepted Answer · 2011-12-25 01:53:04Z

1

You forgot to add a ? in your SQL.

$stmt = $this->db->prepare('SELECT username FROM members WHERE username=?', $code); 

echo "dbprepare";

$stmt->bind_param("is", $code);

answered Dec 25, 2011 at 1:53

Lion

19.1k22 gold badges83 silver badges111 bronze badges

Collectives™ on Stack Overflow

PHP Checking if something exists in database

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related