将此MySQLi查询编写为预准备语句

Question

I have an existing MySQLi query:

$conn = dbConnect('query');
$galNumb = "SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project = {$project}";
$gNumb = $conn->query($galNumb);
$row = $gNumb->fetch_row();
$galTotal = $row[0];

This counts the number of galleries per project that match the value in the query string contained in $project.

It works perfect but is not secure compared to a prepared statement. I have been researching this for two days and can not learn how to write this statement as a prepared statement. Any and all help will be insanely appreciated.

UPDATE: I am flying by the seat of my pants here. I simply need to be shown how to code the above as a prepared statement. This sort of thing isn't resonating with my brain like learning PHP did and I'm just not getting any of this. The PHP manual is confusing and seems to be written for people who already understand PHP.

In short, I need a prepared statement version of the above code so that I can echo the result on the page. Currently, with what is in my DB, the number should be 3, and it consistently returns 1.

I wish I knew more so that I could better phrase my questions, but alas, I'm still learning. My apologies.

UPDATE 2: Based on suggestions and research, I have this query written, but it ALWAYS returns the value 1, regardless of what's actually in the database:

$galNumb = "SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project_part = ?";
$stmt = $conn->prepare($galNumb);
$stmt->bind_param('i', $project);
$gNumb = $stmt->execute();

Again, All I want to do is COUNT how many galleries are in each project. I know this should be simple but it isn't for me. There is currently 1 project in the DB with 3 galleries. The query should return 3.

Answer 1

This is as simple as it gets. This will prepare a sql statement, execute it and fetch the first row.

<?php

// create the prepared statement
$stmt = $conn->prepare('SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project = ?');

// bind a variable to the statment
// the character denotes the type of the variable
// 's' for string
// 'i' for integer
$stmt->bind_param('i', $project);

// execute the query
$stmt->execute();

// get the result variable
$result = $stmt->get_result();

// fetch the row
$row = $result->fetch_row();

if ($row) {
    echo "The count is " . $row[0]; 
}

?>

The documentation is pretty straightforward. You have a code example at the bottom.

http://php.net/manual/en/mysqli.prepare.php