Make this function work with prepare - php

Question

I have seen this function online to bring a basic support for named parameters for MySQli:
function parseNamedParams(&$queryStr, &$params)
{
$array = array();
if ($c = preg_match_all('/(:\w+)/is', $queryStr, $matches)) { // To match words starting with colon
$list = $matches[0]; // $matches is two-dimensional array, we only need first element
foreach($list as $value) { // We'll replace each parameter in the query string with a '?' (as to comply with mysqli), and make sure the value is in the correct order.
$queryStr = str_replace($value, '?', $queryStr);
$array[] = $params[$value];
}
$params = $array;
}
}
I've been trying to use it:
$DB = new mysqli("host","user","pass","db");
$Query = "SELECT uname FROM test WHERE uname = :user";
$Params = array (
":user" => "Sophie"
);
$Bind = parseNamedParams($Query, $Params);
$SQL = $DB->prepare($Bind);
$SQL->execute();
$SQL->bind_result($Username);
$SQL->fetch();
$SQL->close();
But alas, this does not work
Update
Forgot to include the error message:
Fatal error: Call to a member function execute() on a non-object in
C:\xampp\htdocs\index.php on line 25

Answer 1

If your looking for PDO Style prepared statements, then switch to PDO... But if you really insist on doing this, then I have the following solution:
function Named_Params ($Query, $Params,$DBLink){
$New_Param = array_values($Params);
$Count = 0;
if (preg_match_all('/(:\w+)/is',$Query,$Match)){
$List = $Match[0];
foreach ($List AS $Value){
$Secure_Var = $DBLink->real_escape_string($New_Param[$Count]);
$Query = str_replace($Value,$Secure_Var, $Query);
$Count++;
}
}
return $Query;
}
$DB = new mysqli("","","","");
$Query = "SELECT uname FROM test WHERE uname = ':user'";
$Params = array (
":user" => "Sophie"
);
$Input = Named_Params($Query,$Params,$DB);
$Query = $DB->prepare($Input);
$Query->execute();
$Query->bind_result($Username);
$Query->fetch();
$Query->close();
echo $Name;
Hopefully this is what your looking for