Mysqli准备语句错误？

Question

I've ran into this error with prepared statements, I've just started with prepared statements so go easy on me please, Heres the error:

Warning: mysqli_stmt::bind_result(): Number of bind variables doesn't match number of fields in prepared statement in C:\wamp\www\darkhorizons\login.php on line 31

Heres my code:

if (isset($_POST['submit'])){

$username = $_POST['username'];
$password = $_POST['password'];

if(isset($username) && isset($password)) {

   $mysqli = new mysqli("localhost","root","","phplogin") or die("Couldnt connect!");
    if(mysqli_connect_errno()){
        echo "Connection failed: ". mysqli_connect_errno();
        exit();
    }

    if($stmt = $mysqli -> prepare("SELECT * FROM users WHERE username =? AND password      =? LIMIT 1")){
    $stmt -> bind_param("ss", $username, $password);
    $stmt -> execute();

    $stmt -> bind_result($result);
    $stmt -> fetch();



    $numrows = mysqli_num_rows($result);

} else {
    die("Please enter a username and password!");
}

if($numrows == 1){

    $_SESSION['username'] = $_POST['username'];
    $_SESSION['loggedin'] = true ;

    $query = "SELECT adminflag FROM users WHERE username = '{$_SESSION['username']}' LIMIT 1;";
    $result2 = mysqli_query($connect, $query);
    $numrows2 = mysqli_num_rows($result2);

    if ($numrows2 == 1) {
        $_SESSION['isadmin'] = true;
    }

    header("Location: {$pageLoc}");
    exit(); //It's good to use exit or die (same thing) AFTER using header to redirect

} else {


}

    }
    }

As a side note, Please ignore any mistakes in the code below the prepared statement, im redoing my login script that ive been using to learn.

Answer 1

Going through your code you didn't really need to query you DB twice, you should read the adminflag in that same select.

SELECT * is never a good idea always select specific fields.

And I also noticed you are using two differnt style, I suggest you to stick to the Object oriented approach.

<?php
if (isset($_POST['submit'], $_POST['username'] , $_POST['password'])){

$username = $_POST['username'];
$password = $_POST['password'];

$mysqli = new mysqli("localhost","root","","phplogin");

/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s
", mysqli_connect_error());
    exit();
}

$query = "SELECT adminflag FROM users WHERE username = ? AND password = ? LIMIT 1";
if ($stmt = $mysqli->prepare($query)) {
    $stmt -> bind_param("ss", $username, $password);
    $stmt->execute();

        $stmt->store_result();
        $numrows = $stmt->num_rows;
        printf("Number of rows: %d.
", $numrows );

    if($numrows == 1){
        $stmt->bind_result($admin_flag);
        $stmt->fetch();
        session_start();
        if ($admin_flag== 1) {
            $_SESSION['isadmin'] = true;
        }
        $_SESSION['username'] = $username;
        $_SESSION['loggedin'] = true ;
        header("Location: {$pageLoc}");
    }else{
        echo 'user not found';
    }

}
$stmt->close();
$mysqli->close();
}else{
    echo 'required field missing';
}
?>