HI,
I’m trying to switch from mysql to mysqli with prepared statements. I read that is considered safer from sql injection.
Now my unprepared query and output are working fine (in mysqli). But I’m running into trouble with the Group_Concat function in the process. I hope somebody can point out to me where I’m going wrong (or what I am trying to make the query do this way).
$stmt = mysqli_prepare($con, "SELECT pets.PET_ID, pets.Petname, pets.imageurl, pets.str, pets.HP, pets.dex, pets.luck, pets.con, pets.int, pets.learningslots, pets.growth, pets.Levelmin, pets.Levelmax,
elements.elementname,
elementgrowth.EL_growth,
GROUP_CONCAT(DISTINCT locations.LOC_ID, ‘\t’, locations.URLtomap , ‘\t’ , locations.Location ORDER BY locations.Location SEPARATOR ‘\r\n’) AS locidlist
/note without group_concat and the join of petlocations and locations the function runs perfectly/
From pets
JOIN petlocations
ON petlocations.PET_ID=pets.PET_ID
JOIN locations
ON petlocations.LOC_ID=locations.LOC_ID
JOIN elements
ON pets.element_id=elements.element_id
JOIN elementgrowth
ON elements.element_id=elementgrowth.element_id
where elements.elementname=?");
/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, "s", $selected_val1);
/note selected_val1 is user input from a form field with Post/
/* execute query */
mysqli_stmt_execute($stmt);
/* bind result variables */
mysqli_stmt_bind_result($stmt, $PET_ID, $Petname, $imageurl, $str, $HP, $dex, $luck, $con, $int, $learningslot, $growth, $Levelmin, $Levelmax, $elementname, $EL_growth, $locidlist);
/note: not sure what about the locidlist I need to bind or how/
/* store result variables */
mysqli_stmt_store_result($stmt);
/* count the rows */
$count = mysqli_stmt_num_rows($stmt);
if ($count>0)
{
and the rest to echo the result to the screen.