No Data Supplied for Parameters in Prepared Statement

Question

424 votes

1 answers

php - "No data supplied for parameters in prepared argument"

Go the solution ↓↓↓

So I am reworking a script to include prepared statements. It was working fine earlier, but now I am getting "No data supplied for parameters in prepared statement" when the script runs. What is the issue here?

                <?php require_once("models/config.php");   $firstname = htmlspecialchars(trim($_POST['firstname'])); $firstname = mysqli_real_escape_string($mysqli, $firstname); $surname = htmlspecialchars(trim($_POST['surname'])); $surname = mysqli_real_escape_string($mysqli, $surname); $address = htmlspecialchars(trim($_POST['address'])); $accost = mysqli_real_escape_string($mysqli, $address); $gender = htmlspecialchars(trim($_POST['gender'])); $gender = mysqli_real_escape_string($mysqli, $gender); $city = htmlspecialchars(trim($_POST['city'])); $city = mysqli_real_escape_string($mysqli, $metropolis); $province = htmlspecialchars(trim($_POST['province'])); $province = mysqli_real_escape_string($mysqli, $province); $phone = htmlspecialchars(trim($_POST['phone'])); $telephone = mysqli_real_escape_string($mysqli, $telephone); $secondphone = htmlspecialchars(trim($_POST['secondphone'])); $secondphone = mysqli_real_escape_string($mysqli, $secondphone); $postalcode = htmlspecialchars(trim($_POST['postalcode'])); $postalcode = mysqli_real_escape_string($mysqli, $postalcode); $email = htmlspecialchars(trim($_POST['electronic mail'])); $email = mysqli_real_escape_string($mysqli, $e-mail); $organization = htmlspecialchars(trim($_POST['organization'])); $organization = mysqli_real_escape_string($mysqli, $organization); $inriding = htmlspecialchars(trim($_POST['inriding'])); $inriding = mysqli_real_escape_string($mysqli, $inriding); $ethnicity = htmlspecialchars(trim($_POST['ethnicity'])); $ethnicity = mysqli_real_escape_string($mysqli, $ethnicity); $senior = htmlspecialchars(trim($_POST['senior'])); $senior = mysqli_real_escape_string($mysqli, $senior); $pupil = htmlspecialchars(trim($_POST['student'])); $educatee = mysqli_real_escape_string($mysqli, $student);   $social club= "INSERT INTO persons (firstname, surname, accost, gender, city, province,  postalcode, phone, secondphone, electronic mail, organization, inriding, ethnicity, senior, student_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; $stmt = mysqli_prepare($mysqli, $order); mysqli_stmt_bind_param($stmt, "sssd", $firstname, $surname, $address, $gender, $city, $province, $postalcode, $telephone, $secondphone, $email, $organization, $inriding, $ethnicity, $senior, $student); mysqli_stmt_execute($stmt);  echo $stmt->error;  $result = mysqli_query($mysqli,$stmt); if ($issue === simulated) { echo "Mistake inbound information! <BR>"; echo mysqli_error($mysqli);  } else { echo "User $firstname added <BR>";  } ?>

Thanks in advance.

Undefined asked

2021-12-i

Source

Share

Didn't notice the answer?

Our community is visited by hundreds of web evolution professionals every day. Ask your question and get a quick respond for free.

Answer

Solution:

You lot have just bound four arguments, by the command string "sssd", but you have many parameters. When bounden variables with mysqli, you need one character for each parameter, for example:

                  mysqli_stmt_bind_param($stmt, "sssdsssssssssdd", $firstname, $surname, $accost,      $gender, $city, $province, $postalcode, $phone, $secondphone, $email,      $system, $inriding, $ethnicity, $senior, $student);

(I'yard bold senior and student are integers, and need the "d" lawmaking.)

You don't need to care for any of your variables with mysqli_real_escape_string() -- that's the betoken of using parameters. If you do escaping likewise, yous'll get literal backslash characters in your data in the database.

And y'all never need to use htmlspecialchars() in any case - you lot would utilise that when outputting to HTML, not when inserting to the database. You're going to go literal sequences like& in your data in the database.

Re your next error:

"Catchable fatal error: Object of course mysqli_stmt could not exist converted to cord in..."

This is caused past the post-obit:

                  $result = mysqli_query($mysqli,$stmt);

That function expects the second argument to be a string, a new SQL query. Merely you've already prepared that query, and then you need the following:

                  $result = mysqli_stmt_execute($stmt);

Random Posts

No Data Supplied for Parameters in Prepared Statement