嘗試修復更新語句後致命錯誤

Question

我試圖讓update語句安全地againts sql注入，但它給了我這個錯誤致命錯誤：調用一個成員函數bind_param（）在線上的非對象39

$pid = $_POST['pid']; 
$pagetitle = $_POST['pagetitle']; 
$linklabel = $_POST['linklabel']; 
$keyword = $_POST['keyword']; 
$descriere = $_POST['descriere']; 
$data = $_POST['data']; 
$pagebody = $_POST['pagebody']; 
// Filter Function ------------------------------------------------------------------- 
function filterFunction ($var) { 
    $var = nl2br(htmlspecialchars($var)); 
    $var = str_replace("/", "\\\\", $var); 
    $var = preg_replace("~/~", "\\\\", $var); 

    return $var; 
} 
$pagetitle = filterFunction($pagetitle); 
$linklabel = filterFunction($linklabel); 
$keyword = filterFunction($keyword); 
$descriere = filterFunction($descriere); 
$data = filterFunction($data); 
$pagebody = filterFunction($pagebody); 
// End Filter Function -------------------------------------------------------------- 
include_once "../conx.php"; 
// Add the updated info into the database table 
$stmt = $con->prepare("UPDATE pages SET (pagetitle, linklabel, keywords, description, pagebody, lastmodified) VALUES (?, ?, ?, ?, ?, ?) WHERE id = ?"); 
    // TODO check that $stmt creation succeeded 
    // "s" means the database expects a string 
    $stmt->bind_param("sssssss", $pagetitle, $linklabel, $keyword, $descriere, $pagebody, $data, $pid); 
    $stmt->execute(); 
    $stmt->close(); 

線39 $stmt->bind_param("sssssss", $pagetitle, $linklabel, $keyword, $descriere, $pagebody, $data, $pid);

有必要提出這樣或我可以恢復到它是如何

$query = mysqli_query($con, "UPDATE pages SET pagetitle='$pagetitle', linklabel='$linklabel', pagebody='$pagebody', lastmodified='now()' WHERE id='$pid'") or die (mysqli_error($con)); 

Answer 1

之前沒有這個產生埃羅R'

$con->prepare("UPDATE pages SET (pagetitle, linklabel, keywords, description, pagebody, lastmodified) VALUES (?, ?, ?, ?, ?, ?) WHERE id = ?"); 

這應該是

$con->prepare("UPDATE pages SET pagetitle=?, linklabel=?, keywords=?, description=?, pagebody=?, lastmodified=? WHERE id = ?"); 

參見：http://dev.mysql.com/doc/refman/5.7/en/update.html

現在就可以進行參數綁定

$stmt->bind_param("sssssss", $pagetitle, $linklabel, $keyword, $descriere, $pagebody, $data, $pid);