Since @droopsnoot was able to provide a small sample of mysqli_*, I’ll explain a few things about mysqli_* compared to PDO. mysqli_* is very different from the old and removed mysql_* functions. Just appending an i after mysql will not always be sufficient enough. You have to understand how mysqli_* works and most importantly, how stmt works since that’s what droopsnoot was guiding you towards.
The only actual difference between a PDO prepared statement and a mysqli_* prepared statement is usually in the query and how the prepared statement is executed. Otherwise, it’s actually pretty easy to toggle between the 2 drivers when learning them.
For mysqli_*, you can only use the ? placeholder in your query. Using the same example from droopsnoot’s sample.
UPDATE juniortrophies set show_hide='N', dedication = ? WHERE id = ?
Notice the ? in the query. You also have to take in effect for the data types you have to also append to the bind_param method. Each data type has its own purpose and using them incorrectly may result in this error Call to a member function bind_param() on boolean. The data types are
s - string
i - integer
d - double
b - blob
I fell into this trap a while back. I wasn’t paying attention to what I was doing and found myself getting the error Call to a member function bind_param() on boolean and I couldn’t for the life of me figure out why it was throwing me that error. Understand, I’ve seen dozens and dozens of errors and I know exactly when they will happen by just looking at the code because I’ve trained my eyes to do so. What I didn’t train myself to do was understand other data types in SQL. So what I essentially was doing was using ENUMs which are kind of like a list of strings in SQL and I was putting integers in there. Then in my bind_param method I kept appending integer data types to those columns/variables. That’s what was throwing me the error Call to a member function bind_param() on boolean. It’s because ENUMs are essentially strings and not integers, but I kept thinking they were real integers because I was putting them in a list of integers.
Moral of the story is, understand which data type you are appending to bind_param before you start executing it. It might not be the correct data type even if you think it is.
In PDO, you have 2 choices. You can either use the ? placeholder or you can use parametrized names. There are also about 3 different ways to bind and execute the prepared statement. All of which pretty much do the same exact thing almost. And that’s to avoid SQL Injections. The only difference is between execution time.
First way
$prepare = $pdo->prepare('UPDATE juniortrophies set show_hide='N', dedication = :dedication WHERE id = :id');
$prepare->bindValue(':dedication', $dedication, PDO::PARAM_STR);
$prepare->bindValue(':id', $id, PDO::PARAM_INT);
$prepare->execute();
Second way
$prepare = $pdo->prepare('UPDATE juniortrophies set show_hide='N', dedication = :dedication WHERE id = :id');
$prepare->bindParam(':dedication', $dedication, PDO::PARAM_STR);
$prepare->bindParam(':id', $id, PDO::PARAM_INT);
$prepare->execute();
Third way
$prepare = $pdo->prepare('UPDATE juniortrophies set show_hide='N', dedication = :dedication WHERE id = :id');
$parameters = [
':dedication' => $dedication,
':id' => $id,
];
$prepare->execute($parameters);
Personally, I like the third way more because you don’t have a bunch of bindParam or bindValue lines clogging up your code. You can even cut the spacing and indentation of the array in the third example as well making it use less lines of code. Like so.
$prepare = $pdo->prepare('UPDATE juniortrophies set show_hide='N', dedication = :dedication WHERE id = :id');
$parameters = [':dedication' => $dedication, ':id' => $id];
$prepare->execute($parameters);
But there’s your crash course to see how different running either mysqli_* or PDO is like.
Thanks for the thought though.
)