Binding fields as values with mysqli? - php

Question

I have a PHP application I am developing. It contains a function that edits a user in the database. The function accepts false or a value as its arguments; false means that field should be left as is.
Currently, I am using this code:
function edit_user($id, $name = false, $key = false, $mode = false, $notes = false){
$changes = array();
$changestr = "";
$values = array();
if($name !== false){
$changes[] = "name=?";
$values[] = &$name;
}
// 3 more identical ifs
for($i = 0; $i < count($changes); $i++) $changestr .= 's';
$changestr .= 'i';
$values[] = &$id;
array_unshift($values, $changestr);
$query = $db_connection->prepare("UPDATE users SET " . join(",", $changes) . " WHERE userId=?");
call_user_func_array(array($query, "bind_param"), $values);
$query->execute();
return $query->affected_rows >= 1;
}
(Yes, I know the values are not escaped, I do it elsewhere.)
Something, however, is not working here. What I'd like to do to improve it is just have the query like this:
UPDATE users SET name=?,password=?,mode=?,notes=? WHERE userId=?
And then just bind the field name if I need to leave it as is. What I'm asking, is this possible to do with mysqli? Or does the prepared statement break my idea?
UPDATE: What I mean is can I use mysqli like this:
Take this query:
UPDATE users SET name=?,password=?,mode=?,notes=? WHERE userId=?
Update some values but leave some as is, like this:
UPDATE users SET name='Test',password=password,mode=mode,notes='asdf' WHERE userId=723

Answer 1

#Pietu1998 Yes it's more clear.
The answer it's simple: you cant'd do that. You can however get the same result with some tricks as creating some functions like this
function buildSQLComparison($name,$value=false) {
return $name . '=' . ($value)?$value : $name;
}
function buildSQLComparisonForBinding($name,$value=false) {
return $name . '=' . ($value)?'?' : $name;
}
and call it:
$sqlNamePart = buildSQLComparisonForBinding($$name,$name);
$sqlPasswordPart = buildSQLComparisonForBinding($$password,$password);
$param = array($sqlNamePart,$sqlPasswordPart );
$query = $db_connection->prepare("UPDATE users SET " . join(",",$param);
I hope this can be useful for you.
PS: I suggest you to avoid to use reference to var (es:&$name;)
UPDATE:
read at us.php.net/manual/en/mysqli-stmt.bind-param.php, you can do simply build a query doing that:
$stmt = $mysqli->prepare("UPDATE users SET name=?,password=?,mode=?,notes=? WHERE userId=?");
$stmt->bind_param('ssss',
$name?$name:$$name,
$password?$password:$$password,
$mode?$mode:$$mode,
$notes?$notes:$$notes);
I hope this can be useful