MySQLi Prepared statements and fetching fields - php

Question

I have an array of strings called $lines and I want to search a database with each string.
What I have that works:
foreach($lines as $line) {
$line = real_escape_string($line);
$sql = "select * from $table where $column like '%$line%'"
$result = $conn->query($sql);
if($result->num_rows) {
while ($row = $result->fetch_assoc())
//Name and Date are are only 2 out of 15+ column names from the db table
echo "<tr><td> {$row['Name']} </td>
<td> {$row['Date']} </td></tr>";
}
However, I don't want this. I want to use prepared statements and be able to use column names like above. What I've tried: (from here)
$vars = array();
$data = array();
$stmt = $conn->prepare("SELECT * FROM $table WHERE `$column` LIKE '%?%'");
$stmt->bind_param("s", $line);
$stmt->execute();
$result = $stmt->store_result();
$meta = $result->result_metadata();
echo "WORKS"; //doesn't print
while ($field = $meta->fetch_field())
$vars[] = &$data[$field->name];
call_user_func_array(array($result, 'bind_result'), $vars);
$i = 0;
while ($result->fetch()) {
$array[$i] = array();
foreach ($data as $k=>$v)
$array[$i][$k] = $v;
$i++;
}
print_r($array);

Answer 1

As using prepared statements bypasses the need for quotes and passes in the exact variable, you need to pass the wildcards in on your variable, not in the query:
$stmt = $conn->prepare("SELECT * FROM $table WHERE `$column` LIKE ?");
$stmt->bind_param("s", '%'.$line.'%');