Question

My function looks like that.

if (isset($_POST['type'])) {
    switch ($_POST['type']) {
        case "qsubject":
            $sql = "SELECT id, name FROM chapters WHERE subject_id=?";
            break;
        case "qchapters":
            $sql = "SELECT id, name FROM sections WHERE subject_id=? AND chapter_id=?";
            break;
        case "qsections":
            $sql = "SELECT id, name FROM paragraphs WHERE subject_id=? AND chapter_id=? AND section_id=?";
            break;
    }
    $stmt = $db->prepare($sql) or die($db->error());
    $stmt->bind_param("i", $id);
    $stmt->execute();
    $stmt->store_result();
    if ($stmt->num_rows > 0) {
        $stmt->bind_result($chp_id, $name);
        echo '<option value="#"></option>';
        while ($stmt->fetch())
            echo '<option value="' . $chp_id . '">' . $name . '</option>';
    }
    else
        echo 0;
    $stmt->close();
}

For every switch case $params ($stmt->bind_param($params);) must be different.

So what I want to do is to create $params inside switch

$params='"i"'.$id; 

Then use it like this

$stmt->bind_param($params);

Is that possible?

Answer 1

I don’t really know if that is what you want, but just put the prepare() and bind_param() calls inside the case-statement:

if (isset($_POST['type'])) {
    switch ($_POST['type']) {
        case "qsubject":
            $sql = "SELECT id, name FROM chapters WHERE subject_id=?";
            $stmt = $db->prepare($sql) or die($db->error());
            $stmt->bind_param("i", $id);
            break;
        case "qchapters":
            $sql = "SELECT id, name FROM sections WHERE subject_id=? AND chapter_id=?";
            $stmt = $db->prepare($sql) or die($db->error());
            $stmt->bind_param("ii", $id, $chapter_id);
            break;
        case "qsections":
            $sql = "SELECT id, name FROM paragraphs WHERE subject_id=? AND chapter_id=? AND section_id=?";
            $stmt = $db->prepare($sql) or die($db->error());
            $stmt->bind_param("iii", $id, $chapter_id, $section_id);
            break;
    }
    $stmt->execute();
    $stmt->store_result();
    if ($stmt->num_rows > 0) {
        $stmt->bind_result($chp_id, $name);
        echo '<option value="#"></option>';
        while ($stmt->fetch())
            echo '<option value="' . $chp_id . '">' . $name . '</option>';
    }
    else
        echo 0;
    $stmt->close();
}

you are doing 3 different queries, so it’s totally fine to have 3 different prepare()-calls.

if you can’t use this approach you could also create a simple array to store your parameters.

$params = array();
case "qsubject":
     $params[] = array("type"=>"i", "value"=>$id);
     break;

case "qchapters":
     $params[] = array("type"=>"i", "value"=>$id);
     $params[] = array("type"=>"i", "value"=>$chapter_id);
     break;

// probably won't work, see text below.
foreach ($params as $param)
     $stmt->bind_param($param["type"], $param["value"]);

it seems that you have to provide all the variables when calling the bind_param statement. you can still call bind_param with a variable count of arguments. see the comments on http://php.net/manual/de/mysqli-stmt.bind-param.php for a solution.