Mysqli Update Prepare Failing - php

Question

if ($stmt = $mysqli->prepare("UPDATE profile SET fullname =?, guardian =?,
addressline1 = ?, addressline2 = ?, city = ?, stateid = ?, pin = ?, birthdate = ?,
bloodgroup= ?, allergydetails= ?, pancardno= ?, officephone= ?, residencephone= ?,
mobilephone= ?, drivinglicensenumber= ?, drivinglicensevalidupto= ?,
fmscidrivinglicensenumber= ?, fmscientrantlicensenumber= ?, vehiclemake= ?,
vehiclemodel= ?, vehiclenumber= ?, vehicleyear= ?, emergencyname= ?,
emergencyaddress1= ?, emergencyaddress2= ?,emergencylandphone= ?,
emergencymobilephone= ?, isprofilecomplete = ? WHERE username = ?"))
{
$stmt->bind_param('sssssississsssssssssssssssssi', $fullname, $sodowo,
addressline1, $addressline2, $city, $stateid, $pin, $birthdate, $bloodgroup,
$allergydetails, $pancardno, $officephone, $residencephone, $mobilephone,
$drivinglicensenumber, $drivinglicensevalidupto, $fmscidrivinglicensenumber,
$fmscientrantlicensenumber, $vehiclemake, $vehiclemodel, $vehiclenumber, $vehicleyear,
$emergencyname, $emergencyaddress1, $emergencyaddress2, $emergencylandphone,
$emergencymobilephone, $isprofilecomplete , $username );
$stmt->execute();
$stmt->close();
}
When the above update statement is executed it is updating all the rows with the values instead of the WHERE clause. Any ideas why this is happening?
Thanks.

Answer 1

The last value of the types string for bind param (first parameter ("sssssississsssssssssssssssssi") is an "i" for integer but you're comparing it to "username" which is probably a string.
I guess the value you're passing in is converted to 0 and comparing 0 to any string in MySQL is always true (see mysql: why comparing a 'string' to 0 gives true?).
Try changing the last "i" for a "s" in "sssssississsssssssssssssssssi" (which is really horrible to read and hence very error-prone btw.)