bind_param mysqli_stmt_bind_param to Bind variables to a prepared statement as parameters

Bind values to placeholders

bind_param() receives a type string followed by variables that correspond to the placeholders in the prepared SQL statement.

<?php
$stmt = $connection->prepare('SELECT name, mark FROM student WHERE id = ?');
$id = 10;
$stmt->bind_param('i', $id);
$stmt->execute();
?>

Current example first; the detailed examples below are retained for additional learning and comparison.

$query="UPDATE  student SET class=?,mark=? WHERE id=?";

Student Table : Sample Data and query to create table
config.php Database connection object $connection is taken from config.php file.

<?php
require "config.php";// Database connection file.

$class='Three';
$mark=66;
$id=5;
$query="UPDATE  student SET class=?,mark=? WHERE id=?";
$stmt = $connection->prepare($query);
if ($stmt) {
$stmt->bind_param('sii', $class, $mark, $id);
$stmt->execute();
echo "Record Updated:";
echo $stmt->affected_rows;
}else{
echo $connection->error;
}
?>

In MySQLi prepared statements, the ? (question mark) is used as a placeholder for each input value in the query. These placeholders are later replaced with actual input values when you bind the parameters using bind_param(), which ensures the input values are safely incorporated into the query, preventing SQL injection and other vulnerabilities.

$stmt->bind_param('<span class='text-danger'>sii</span>', $class, $mark, $id);

Types : Here is the list of variable Types we have to mention.

i: Integer , tiny small medium
s: String 
d: Double 
b: Bolb

Procedural style

$class='Three';
$mark=68;
$id=5;
$query="UPDATE  student SET class=?,mark=? WHERE id=?";
if ($stmt = mysqli_prepare($connection,$query)){
mysqli_stmt_bind_param($stmt, "sii", $class, $mark, $id);
mysqli_stmt_execute($stmt);
echo "Record Updated:";
echo mysqli_affected_rows($connection);

}else{
echo mysqli_error($connection);
}

Bind parameters to a prepared statement as parameter.

Returns True on success and False on failure.

Object Oriented Style

$stmt->bind_param('sii', $class, $mark, $id);

Procedural style

mysqli_stmt_bind_param($stmt, "si",$class, $id);

Used with prepare() to bind parameters to variables used inside Query.

No need to use mysqli_real_escape_string() if you are using bind_param()

MySQL DUMP of student table

MYSQLI Functions mysql_query() : Apply query to database

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author Watch on YouTube

Connect:

Subscribe to our YouTube Channel here

bind_param() in MySQLi Prepared Statements

Bind values to placeholders

Procedural style

Bind parameters to a prepared statement as parameter.

Subhendu Mohapatra