sqli错误与prepare语句

Question

this is my first time using Mysqli and i been stuck on this problem for about an hour now. I am getting this error

mysqli_stmt::bind_param(): Number of variables doesn't match number of parameters 
in prepared statement in C:\wamp\www\WebContent\success.php on line 30

i have counted like 10 times the questions marks in the prepare statement and there are 21, then i counted the s and the variables in bind_param and there are 21 too. I am new at Mysqli, I was wondering if i can get any suggestion on how to aproach and debug this problem, thank you for all your help

<?php   


$mysqli = new mysqli("localhost", "root","","test");
if (mysqli_connect_errno())
 {
    printf("Connect failed: %s
", mysqli_connect_error());
    exit();
 }


    $i=0;

 if ($stmt = $mysqli->prepare("UPDATE `table` SET `Lan_ID` = '?', `Switching` = '?',
   `Own` = '?',`Division` = '?',`Switch_Number` = '?',
   `Telecom_Circuit_number` = '?', `Transmitter_Frequency` = '?',
   `Receiver_Frequency` = '?', `Band_width` = '?', `Channel` = '?', 
   `Equipment` = '?', `Power` = '?', 
   `Line_designation` = '?', `Voltage` = '?', `Phase` = '?',
   `Modulate` = '?', `Terms` = '?', `Trap` = '?',
   `Ltunner` = '?', `Link` = '?', 
   `Comment` = '?' ". $_GET['where'.$i] ))
    {
        $stmt->bind_param('sssssssssssssssssssss', $_GET[$i.'LanID'],$_GET[$i.'Switching'],
        $_GET[$i.'Own'], $_GET[$i.'Division'], $_GET[$i.'Switch_Number'], $_GET[$i.'Telecom_Circuit_number'],
        $_GET[$i.'Trasmitter_frq'], $_GET[$i.'Receiver_frq'], $_GET[$i.'Band_width'], $_GET[$i.'Channel'],
        $_GET[$i.'Equipment'], $_GET[$i.'Power'], $_GET[$i.'Line_designation'],$_GET[$i.'Voltage'],
        $_GET[$i.'Phase'],$_GET[$i.'Modulate'],$_GET[$i.'Terms'], $_GET[$i.'Trap'],$_GET[$i.'Ltunner'],
        $_GET[$i.'Link'], $_GET[$i.'Comment'] );//this is line 30 btw


    }
    else 
    {
        printf("Prepared Statement Error: %s
", $mysqli->error);

    }
    $stmt->close();
 ?>

Answer 1

Don't put parameter placeholders inside quotes.

But that's just the start of your problems. By interpolating $_GET['where'.$i] into your query, you've opened yourself up to SQL injection attacks. You've completely missed the point of secure programming.

You must not take a WHERE clause, or any expression, verbatim from the HTTP request and copy it into your SQL string. But you can't use a query parameter for an SQL expression, you can only use a parameter in place of a single scalar value.