Question

I’m getting a little lost with my mySQLi bind_params and other related methods. So far I have build a login script using a class structure.

$qu = $this->DBH->prepare("SELECT * FROM CVUSERS WHERE username = ? AND password = ?");
$qu->bind_params('ss',$username,$password);

Now this is where I’m getting lost. As a login script I want to make sure my query only has one result. How can I return an int or boolean from my query string?

bind_result($result);
if($result === 1){
    //this identical statement doesn't work :S
    //using an equals statements works for every entry. Even invalid ones.
    //I've found $result will always equal 1, there is more than one row in my table
}

Answer 1

Mysqli’s support for the prepared statements is quite ugly. So, you can’t get your info an easy way.
For some reason it always require some strange function to call. That’s where your doubts are from.
bind_result() will do literally nothing. it will start working only after you call fetch(). So you see in your code.

Another way is to select not count() but data itself as you did at first and check the number of rows returned. But it’s still require another function call

$qu->execute();
$qu->store_result();
if($qu->num_rows){
    $this->_constructSessions($username);
}

However, If i were you, I’d make it more or less this way

$qu = $this->DBH->prepare("SELECT COUNT(*) FROM CVUSERS WHERE username= ? AND password = ? ");
$qu->bind_param('ss',$username,$password);
$qu->execute();
$res = $stmt->get_result();
$row = $res->fetch_array();
if($row){
    $this->_constructSessions($row);
}

But it’s still toilsome and ugly.
That’s why I never use native prepared statements. So, I make it with just

$sql = "SELECT * FROM CVUSERS WHERE username=?s AND password=?s";
if ($row = $db->getRow($sql,$username,$password)) {
    $this->_constructSessions($row);
}