PHP准备语句错误：无法准备选择

Question

I wanted to select data from MYSQL database. For that I did the following:

$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

mysqli_set_charset($mysqli, "utf8");

date_default_timezone_set("Europe/Berlin");

session_name('User Session'); 
session_start(); 

$private_id = session_id(); 
$private_questions = get_questions($mysqli);

session_write_close(); 

    function get_questions($mysqli, $stmt_get_questions) { 
    $stmt = $mysqli->query($stmt_get_questions);

    $questions = array();

    while($question = $stmt->fetch_assoc()) {
        $questions[] = $question;   
    }

    $stmt->close();
    $mysqli->close();

    return $questions;
}

And call my variable in HTML:

<div class="container">

    <p>Private ID is <?=$private_id?></p>
    <p>Questions <?=$private_questions?></p>
</div>

But I get an internal server error:

GET mywebsite/myhtml.html 500 (Internal Server Error)

I can't find the problem. The MYSQL Select is correct.

Answer 1

You got confused in the concept.

You can run that SELECT statement like this:

$stmt_select = "SELECT A, B, C FROM MY_TABLE";
$stmt = $mysqli->query($stmt_select);

Or if you want to have protection against MYSQL injection hacks then you can use prepared function like this: (Pay attention that in a prepared statement you must have question marks "?" and then use bind_param() function)

 if ($stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {

/* bind parameters for markers */
$stmt->bind_param("s", $city);

/* execute query */
$stmt->execute();

/* bind result variables */
$stmt->bind_result($district);

/* fetch value */
$stmt->fetch();

printf("%s is in district %s
", $city, $district);

/* close statement */
$stmt->close();
}

Read this link for more clarification:

Mysql prepared statement

The full answer goes as follow:

 $mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

 $mysqli_set_charset($mysqli, "utf8");

 date_default_timezone_set("Europe/Berlin");

 $stmt_get_questions = "SELECT A, B, C FROM MY_TABLE";

 session_name('User Session'); 
 session_start(); 

 $private_id = session_id(); 
 $private_questions = get_questions($mysqli);

 session_write_close(); 

 function get_questions($mysqli) { 
 // Execute the MYSQL statement
 $stmt = $mysqli->query($stmt_get_questions);

 // Get the result and iterate through it
 while($row = $stmt->fetch_assoc()) {
     // Do Something with the each row, Like reading a column:
     $column_one = $row['column_one'];  
 }

 $stmt->close();
 $mysqli->close();

 return $questions;
 }