prepare statement for insert in php failed in my case - php

Question

I am using ajax and I can't tell what the error is, but I am certain that the data has been inserted in my database. Here is what I tried:
if(isset($_POST['user_id']) && isset($_POST['content']) && isset($_POST['date']) && isset($_POST['category_id'])){
$content = $_POST['content'];
$date = $_POST['date'];
$user_id = $_POST['user_id'];
$category_id = $_POST['category_id'];
$stmt = $db->prepare("INSERT INTO post_items(`post_id`,`content`,`date`,`user_id`,`category_id`)
VALUES (?,?,?,?)");
$stmt = bind_param('ssii',$content,$date,$user_id,$category_id);
if($stmt->execute()) {
echo mysqli_insert_id($db);
}else{
echo "Something is wrong. Insert failed..";
}
}
My old working version (with the lack of security) is shown below:
if(isset($_POST['user_id']) && isset($_POST['content']) && isset($_POST['date']) && isset($_POST['category_id'])){
$content = $_POST['content'];
$date = $_POST['date'];
$user_id = $_POST['user_id'];
$category_id = $_POST['category_id'];
/* $result = $db->query("INSERT INTO post_items(`content`,`date`,`user_id`,`category_id`)
VALUES (".$content."', '".$date."', '".$user_id."', '".$category_id."')");*/
$stmt = $db->prepare("INSERT INTO post_items(`post_id`,`content`,`date`,`user_id`,`category_id`)
VALUES (?,?,?,?)");
$stmt = bind_param('ssii',$content,$date,$user_id,$category_id);
if($stmt->execute()) {
echo mysqli_insert_id($db);
}else{
echo "Something is wrong. Insert failed..";
}
}
I am not sure what I did wrong here as it is the first time that I have worked with this material.

Answer 1

First of all, you don't bind the same number of parameters as value you assign...
Also, The way you are using bind_param is wrong. It should be
if(isset($_POST['user_id']) && isset($_POST['content']) && isset($_POST['date']) && isset($_POST['category_id'])){
$content = $_POST['content'];
$date = $_POST['date'];
$user_id = $_POST['user_id'];
$category_id = $_POST['category_id'];
$stmt = $db->prepare("INSERT INTO post_items(`content`,`date`,`user_id`,`category_id`)
VALUES (?,?,?,?)");
$stmt->bindParam(1, $content);
...
$stmt->bindParam(4, $category_id);
if($stmt->execute()) {
echo mysqli_insert_id($db);
}else{
echo "Something is wrong. Insert failed..";
}
}
or you could also do the following :
if(isset($_POST['user_id']) && isset($_POST['content']) && isset($_POST['date']) && isset($_POST['category_id'])){
$content = $_POST['content'];
$date = $_POST['date'];
$user_id = $_POST['user_id'];
$category_id = $_POST['category_id'];
$stmt = $db->prepare("INSERT INTO post_items(`content`,`date`,`user_id`,`category_id`)
VALUES (?,?,?,?)");
if($stmt->execute(array($content,$date,$user_id,$category_id))) {
echo mysqli_insert_id($db);
}else{
echo "Something is wrong. Insert failed..";
}
}
also just to let you know, pdo has a method to fetch the last id, so instead of
mysqli_insert_id
you could use
$stmt->lastInsertId()
if(isset($_POST['user_id']) && isset($_POST['content']) && isset($_POST['date']) && isset($_POST['category_id'])){
$content = $_POST['content'];
$date = $_POST['date'];
$user_id = $_POST['user_id'];
$category_id = $_POST['category_id'];
$stmt = $db->prepare("INSERT INTO post_items(`content`,`date`,`user_id`,`category_id`)
VALUES (?,?,?,?)");
$stmt->bindParam(1, $content);
...
$stmt->bindParam(4, $category_id);
if($stmt->execute()) {
echo $stmt->lastInsertId();
}else{
echo "Something is wrong. Insert failed..";
}
}