Getting "Invalid parameter number" when updating database, why? - php

Question

I'm trying to make my CMS be able to edit different fields (e.g. name). When I hit "Update", though, I get the following error:
Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens' in /studenthome.hallam.shu.ac.uk/STUDENTHOME10/1/b5035381/public_html/affinity/cms/process/editRecord.php: in /studenthome.hallam.shu.ac.uk/STUDENTHOME10/1/b5035381/public_html/affinity/cms/process/editRecord.php on line 28 PDOException: SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens in /studenthome.hallam.shu.ac.uk/STUDENTHOME10/1/b5035381/public_html/affinity/cms/process/editRecord.php on line 28 Call Stack: 0.0029 659144 1. {main}() /studenthome.hallam.shu.ac.uk/STUDENTHOME10/1/b5035381/public_html/affinity/cms/process/editRecord.php:0 0.0135 672928 2. PDOStatement->execute() /studenthome.hallam.shu.ac.uk/STUDENTHOME10/1/b5035381/public_html/affinity/cms/process/editRecord.php:28
Here is my code:
<?php
ini_set('display_errors', 1);
// add your includes for connections and functions
// make sure the path is correct
require ('../../includes/conn.inc.php');
require ('../../includes/functions.inc.php');
// sanitize user variables
$splayerName = safeString($_POST['playerName']);
$splayerDescription = safeString($_POST['playerDescription']);
$splayerImage = safeString($_POST['playerImage']);
$splayerRank = safeString($_POST['playerRank']);
$splayerSpec = safeString($_POST['playerSpec']);
$splayerID = safeInt($_POST['playerID']);
// build prepare statement
$sql = "UPDATE affinity SET playerName = :playerName,
playerDescription = :playerDescription,
playerImage = :playerImage,
playerRank = :playerRank,
playerSpec = :playerSpec
WHERE playerID = :playerID";
$stmt = $pdo->prepare($sql);
$stmt->bindParam(':playerName', $splayerName, PDO::PARAM_STR);
$stmt->bindParam(':playerDescription', $splayerDescription, PDO::PARAM_STR);
$stmt->bindParam(':playerImage', $splayerImage, PDO::PARAM_STR);
$stmt->bindParam(':playerRank', $splayerRank, PDO::PARAM_STR);
$stmt->bindParam(':playerRank', $splayerRank, PDO::PARAM_STR);
$stmt->bindParam(':playerSpec', $splayerSpec, PDO::PARAM_INT);
$stmt->execute();
// redirect browser
header("Location: ../cms.php");
// make sure no other code executed
exit;
?>
I'm not sure why this isn't working; how can I fix it?

Answer 1

:playerRank
has been bound 2 times and
:playerID
Haven't been bound.
And :
:playerSpec
Should be bound as a string, not an int.
$stmt->bindParam(':playerName', $splayerName, PDO::PARAM_STR);
$stmt->bindParam(':playerDescription', $splayerDescription, PDO::PARAM_STR);
$stmt->bindParam(':playerImage', $splayerImage, PDO::PARAM_STR);
$stmt->bindParam(':playerRank', $splayerRank, PDO::PARAM_STR);
$stmt->bindParam(':playerSpec', $splayerSpec, PDO::PARAM_STR);
$stmt->bindParam(':playerID', $splayerID, PDO::PARAM_INT);

Answer 2

Where's your bind for playerID? That's whats causing it. You'e binding Rank twice and ID never, and they should be in order correct?
$stmt->bindParam(':playerName', $splayerName, PDO::PARAM_STR);
$stmt->bindParam(':playerDescription', $splayerDescription, PDO::PARAM_STR);
$stmt->bindParam(':playerImage', $splayerImage, PDO::PARAM_STR);
$stmt->bindParam(':playerRank', $splayerRank, PDO::PARAM_STR);
$stmt->bindParam(':playerSpec', $splayerSpec, PDO::PARAM_INT);
$stmt->bindParam(':playerID', $splayerID, PDO::PARAM_STR);

Answer 3

<?php
ini_set('display_errors', 1);
// add your includes for connections and functions
// make sure the path is correct
require ('../../includes/conn.inc.php');
require ('../../includes/functions.inc.php');
// sanitize user variables
$splayerName = safeString($_POST['playerName']);
$splayerDescription = safeString($_POST['playerDescription']);
$splayerImage = safeString($_POST['playerImage']);
$splayerRank = safeString($_POST['playerRank']);
$splayerSpec = safeString($_POST['playerSpec']);
$splayerID = safeInt($_POST['playerID']);
// build prepare statement
$sql = "UPDATE affinity SET playerName = :playerName,
playerDescription = :playerDescription,
playerImage = :playerImage,
playerRank = :playerRank,
playerSpec = :playerSpec
WHERE playerID = :playerID";
$stmt = $pdo->prepare($sql);
$stmt->bindParam(':playerName', $splayerName, PDO::PARAM_STR);
$stmt->bindParam(':playerDescription', $splayerDescription, PDO::PARAM_STR);
$stmt->bindParam(':playerImage', $splayerImage, PDO::PARAM_STR);
$stmt->bindParam(':playerRank', $splayerRank, PDO::PARAM_STR);
$stmt->bindParam(':playerSpec', $splayerSpec, PDO::PARAM_STR);
$stmt->bindParam(':playerID', $splayerID, PDO::PARAM_INT);
$stmt->execute();
// redirect browser
header("Location: ../cms.php");
// make sure no other code executed
exit;
?>