Question

So I’ve been looking for the answer to this problem for ages and cannot find a solution.

The error is:

Invalid parameter number: number of bound variables does not match number of tokens

and of course I know what this error means, but I don’t understand why it’s actually throwing it only when I surround something in single quotes.

Here’s my code:

$query = "UPDATE $DbTableName SET name=':name' WHERE id=:Id";
$result = $dbc->prepare($query); //Prepare query

$values = array('Id' => $Id, 'name' => $name); //Prepare values
$result->execute($values); //Execute Query

see the single quotes around :name

If I remove these quotes then there’s no PDO error, but a MySQL error because a string needs to be surrounded by single quotes..

How can I get around this?

MySQL error when setting name to bob without quotes:

#1054 - Unknown column 'bob' in 'field list'

Thanks in advance

Answer 1

You need to specify that the param is indeed a string, using an example from the PHP manual:

$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit
    WHERE calories < ? AND colour = ?');
$sth->bindParam(1, $calories, PDO::PARAM_INT);
$sth->bindParam(2, $colour, PDO::PARAM_STR);

Technically I believe execute makes a best guess judgement on the type of, but by using bindParam or bindValue you can explicitly state the type.