PHP MySQLInsert prepared statements - php

Question

I am working on learning about PHP prepared statements and implementing them when using the MySQL INSERT command. I am able to do this just fine without the prepared statements, but I am confused on where I went wrong in my code after adding prepared statements.
The below code gives me the "Internal Server Error", but it appears to be syntactically correct.
EDIT:
Here is dbConnet.php:
<?php
$hostname = "*";
$username = "*";
$database = "*";
$password = "*";
$link = mysqli_connect($hostname, $username, $password, $database);
if (!$link)
{
die('Could not connect: ' . mysqli_connect_error());
}
?>
Code:
<?php
include('dbConnect.php');
$stmt = $mysqli->prepare("INSERT INTO Articles (content, date) VALUES (?,?)");
$stmt->bind_param('si', $article, $submitTime);
$article = $_POST['articleArea'];
$submitTime = new DateTime();
$submitTimeString = $submitTime->format("m-d-Y H:i:s");
$stmt->execute();
if (mysqli_query($link,$stmt) )
{
echo "<script language='javascript'>alert('Article has been submitted!')</script>";
echo "<script language='javascript'>window.location = 'URL'</script>";
}
else
{
echo "<script language='javascript'>alert('Uh oh! An error has been encountered! Please try to resubmit your article.')</script>";
echo "<script language='javascript'>window.location = 'URL'</script>";
}
mysqli_close($link);
?>
Any insight into my issue is greatly appreciated. If you need me to add more info, please let me know!
Thanks in advance

Answer 1

Try using
$stmt = $link->prepare("INSERT INTO Articles (content, date) VALUES (?,?)");
$stmt->bind_param('ss', $article, $submitTimeString);
$article = $_POST['articleArea'];
$submitTime = new DateTime();
$submitTimeString = $submitTime->format("m-d-Y H:i:s");
Instead of
$stmt = $mysqli->prepare("INSERT INTO Articles (content, date) VALUES (?,?)");
$stmt->bind_param('si', $article, $submitTime);
$article = $_POST['articleArea'];
$submitTime = new DateTime();
$submitTimeString = $submitTime->format("m-d-Y H:i:s");
If that error is being caused by trying to connect to the database with both $link and $mysqli (as pointed out by deceze) this should fix that issue. As for the date, I would suggest changing "date" to a "text" datatype in your database (hence the $stmt->bind_param('ss', $article, $submitTimeString); vs $stmt->bind_param('si', $article, $submitTimeString);)

Answer 2

Your database connection is $link, yet you use $mysqli->prepare(..). Which is it?
You're execute()ing the $stmt, yet you also next use mysqli_query(). That's nonsense. Use one or the other, not both.
mysqli_query() expects a query string, but you're giving it a prepared statement object.
You're binding $submitTime to the statement, which is a DateTime object, which mysqli will likely not like. You're never using your formatted date $submitTimeString anywhere.
Any one of these mistakes will likely trigger the fatal error. You need to rewrite that from scratch. Read the manual for how to use the mysqli extension.

Answer 3

is $submitTime defined at the time it is bound to $stmt?
Both $article and $submitTime are initialized after being bound.
And you should bind the date string, not the DateTime object.

Answer 4

the $submitTimeString format is wrong. MySQL expects datetimes as date('Y-m-d H:i:s') (year first)