Question

I’m making an iOS app that sends a username string to this PHP file and then the PHP file checks to see if their username exists in a database, in a table called “members”. I got this code online and modified it a little to fit my needs. This is the code:

// Main method to redeem a code
function redeem() {

    // Check for required parameters
    if (isset($_POST["username"])) {

        // Put parameters into local variables
        $code = $_POST["username"];

        echo $code;

        // Look up code in database
        $user_id = 0;

        echo "userid";

        $stmt = $this->db->prepare('SELECT username FROM members WHERE username=', $code); 

        echo "dbprepare";

       $stmt->bind_param("is", $code);

        echo "bindparam";

        $stmt->execute();

        echo "execute";

        $stmt->bind_result($id, $code);

        echo "bindresult";

        while ($stmt->fetch()) {
            break;
        }
        $stmt->close();

The code is tripping up on bind_param, it only gets to echo "dbprepare". Am I doing something incorrectly? How do I check for the username?

Answer 1

You forgot to add a ? in your SQL.

$stmt = $this->db->prepare('SELECT username FROM members WHERE username=?', $code); 

echo "dbprepare";

$stmt->bind_param("is", $code);