获取非法字符串偏移'uid'

Question

Please dont marked as DUPLICATE. I know there are a lot of posts with these error but none seem to be the same issue as mine.

What I am trying to do is to pull up data based on a uid/date from/date to. The UID is related to a login session where it represents the user's ID.

Here is my HTML code,

<input type="text" readonly name="uid" id="uid" value="<?php echo $_SESSION['myusername']; ?>" />
<input type="date" name="from" id="from" value="<?=$date['from']; ?>" />
<input type="date" name="to" id="to" value="<?=$date['to']; ?>" />
<input type="submit" value="Submit" />

So from the code above, UID is a read-only and user can only select dates. So by default user can only get data from db with his own UID using different set of dates.

Here is my SQL code,

if($date['from'] !== NULL && $date['to'] !== NULL){
    // get table data
    $sql = 'SELECT `id`, `changeid`, `implemented_by`
    FROM `tracker` WHERE `implemented_by` = $uid `scheduled_start_date` BETWEEN :d1 AND :d2';
    $stmt = $conn->prepare($sql);
    $stmt->bindParam(':uid', $uid['uid'], PDO::PARAM_STR);
    $stmt->bindParam(':d1', $date['from'], PDO::PARAM_STR);
    $stmt->bindParam(':d2', $date['to'], PDO::PARAM_STR);
    $stmt->execute();
    $result = $stmt->fetchAll(PDO::FETCH_ASSOC);

Now, every time I click on Submit button to retrieved the data I am getting this error,

Warning: Illegal string offset 'uid' in C:\*\update_status_test.php on line 130

Fatal error: Only variables can be passed by reference in C:\*\update_status_test.php on line 130

Line 130 refers to below,

$stmt->bindParam(':uid', $uid['uid'], PDO::PARAM_STR);

Can anyone help me understand why its giving such an error, I'm new to PHP and cant seem to comprehend the error.

Answer 1

Fixed code:

// get table data
// Fixes are in query text
// 1. replace $uid with :uid placeholder
// 2. add `AND` between conditions
$sql = 'SELECT `id`, `changeid`, `implemented_by`
FROM `tracker` WHERE `implemented_by` = :uid AND `scheduled_start_date` BETWEEN :d1 AND :d2';
$stmt = $conn->prepare($sql);
// as `$uid` is a simple string - pass it as is:
$stmt->bindParam(':uid', $uid, PDO::PARAM_STR);
$stmt->bindParam(':d1', $date['from'], PDO::PARAM_STR);
$stmt->bindParam(':d2', $date['to'], PDO::PARAM_STR);
$stmt->execute();
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);