mysqli_stmt :: bind_param（）：在類型定義字符串元素數不匹配綁定變量

所以我認爲我需要執行涉及表單輸入需要這種大規模的頭痛誘導查詢被注入的數數據庫使用mysqli準備好的語句。mysqli_stmt :: bind_param（）：在類型定義字符串元素數不匹配綁定變量

我遇到的問題是它說我試圖調用bind_param的變量數與我使用的「s」的數不匹配。 我數了十幾次，並沒有看到我在哪裏錯了。有65個變量和65個「s」。

有人能看到我丟失的東西？或者我可能以不正確的方式使用bind_param方法？

// Preparing our query statement via mysqli which will auto-escape all bad characters to prevent injection 
$query3 = 'INSERT INTO datashep_AMS.COMPLETE_APPLICATIONS (
    project_name, 
    status, 
    funding_requested, 
    project_title, 
    program, 
    county, 
    parish, 
    name_of_watercourse, 
    which_is_a_tributary_of, 
    name_of_applicant, 
    contact_person_or_project_supervisor, 
    relationship_to_organization, 
    business_phone, 
    home_phone, 
    email, 
    signature_of_thesis_or_study_supervisor, 
    mailing_address, 
    postal_code, 
    website, 
    mailing_address_for_payment, 
    hst_registration_no, 
    total_cost_dollar, 
    total_cost_percent, 
    dollar_amount_requested_from_nbwtf, 
    percent_amount_requested_from_nbwtf, 
    descriptive_summary, 
    background_of_organization, 
    mandate, 
    years_in_existence, 
    membership, 
    accomplishments, 
    previous_project_name, 
    previous_project_number, 
    previous_project_amount_received_from_nbwtf, 
    summary_of_activities, 
    summary_of_Results, 
    project_title_2, 
    reason_and_or_purpose, 
    objectives, 
    project_description, 
    methods, 
    equipment_and_materials_required, 
    personnel_required, 
    proposed_start_date, 
    proposed_end_date, 
    type_of_data_to_be_stored, 
    where_will_it_be_housed, 
    monitoring, 
    short_term_achievement, 
    long_term_achievement, 
    previous_studies, 
    required_permits, 
    consultants, 
    short_term_commitment, 
    long_term_commitment, 
    project_duration, 
    project_evaluation, 
    promotion_of_project, 
    promotion_of_client, 
    publication_of_results, 
    community_benefits, 
    effects_on_traditional_uses, 
    possible_changes_in_public_access_to_areas, 
    possible_impact_on_wildlife_and_or_environment, 
    likelihood_of_future_requests_for_funding, 
    list_all_other_funding_sources_for_this_project 
) VALUES (
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ?, 
    ? 
)'; 

// "Preparing" the query using mysqli->prepare(query) -- which is the equivalent of mysql_real_escape_string -- in other words, it's the SAFE database injection method 
$stmt = $dbConnection->prepare($query3); 

// "Bind_param" == replace all the "?"'s in the aforementioned query with the variables below 

$stmt->bind_param("s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s", $project_name, $status, $funding_requested, $project_title, $program, $county, $parish, $name_of_watercourse, $which_is_a_tributary_of, $name_of_applicant, $contact_person_or_project_supervisor, $relationship_to_organization, $business_phone, $home_phone, $email, $signature_of_thesis_or_study_supervisor, $mailing_address, $postal_code, $website, $mailing_address_for_payment, $hst_registration_no, $total_cost_dollar, $total_cost_percent, $dollar_amount_requested_from_nbwtf, $percent_amount_requested_from_nbwtf, $descriptive_summary, $background_of_organization, $mandate, $years_in_existence, $membership, $accomplishments, $previous_project_name, $previous_project_number, $previous_project_amount_received_from_nbwtf, $summary_of_activities, $summary_of_Results, $project_title_2, $reason_and_or_purpose, $objectives, $project_description, $methods, $equipment_and_materials_required, $personnel_required, $proposed_start_date, $proposed_end_date, $type_of_data_to_be_stored, $where_will_it_be_housed, $monitoring, $short_term_commitment, $long_term_achievement, $previous_studies, $required_permits, $consultants, $short_term_commitment, $long_term_commitment, $project_duration, $project_evaluation, $promotion_of_project, $promotion_of_client, $publication_of_results, $community_benefits, $effects_on_traditional_uses, $possible_changes_in_public_access_to_areas, $possible_impact_on_wildlife_and_or_environment, $likelihood_of_future_requests_for_funding, $list_all_other_funding_sources_for_this_project); 

// Perform the actual query! 
$stmt->execute();

來源

2013-06-21 Samuel Stiles

你從哪裏弄來的是逗號分隔的格式？ –

我仍然不明白爲什麼PHP用戶傾向於爲簡單插入查詢編寫數百千字節的代碼。 –

充分披露：我是初學者，所以我不知道更好的方法（還）。 –

字符串中的字符不應該用逗號隔開：

$stmt->bind_param("sss...", /* variables */);

你可以看到這種格式中的示例演示了the manual page。

來源

2013-06-21 14:01:25 lonesomeday

這似乎是我的問題！謝謝！ –

有65個PARAMS因此，如果有65級的你有正確的號碼。然而，錯誤出現是因爲你用逗號分隔了s。取而代之的$stmt->bind_param("s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s,s..." 應該

$stmt->bind_param("sssssssssssssssss..."

這應該解決您的錯誤。

來源

2016-05-01 18:14:33 PokeSteelProductions

這解決了我的問題。 – AndroidHacker

這幫了我很大的時間！謝謝你，PokeSteelProductions。 –

mysqli_stmt :: bind_param（）：在類型定義字符串元素數不匹配綁定變量

回答

相關問題