Click here to Skip to main content
15,890,882 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am experiencing the following error.

Warning: mysqli_stmt::bind_param(): Number of elements in type definition string doesn't match number of bind variables

How to fix the issue?

Authenticate.php
<?php
require_once "config.php";
session_start(); // Starting Session
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
echo $_POST['username'];
echo $_POST['password'];
$error = ''; // Variable To Store Error Message
    echo "Submit clicked";
if (empty($_POST['username']) || empty($_POST['password'])) {
echo "Username or Password is invalid";
    echo "Still haven't got data";
}else{

$username = $_POST['username'];
$password = $_POST['password'];
$conn = $link;
$query = "SELECT username, password, data FROM mathbglogin WHERE username = '$username' and password = '$password'";
$stmt = $conn->prepare($query);
$stmt->bind_param("sss", $username, $password, $data);
$stmt->execute();
$stmt->bind_result($username, $password, $data);
$stmt->store_result();
if($stmt->fetch()){
$_SESSION['username'] = $username;
$_SESSION['data'] = $data;
    echo $username, $data;
header("location: welcome.php");
mysqli_close($conn); 
    echo "Done!";
}else{
    echo "Unsuccessful";
}
}

?>


config.php

<?php
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', 'users');
 $link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
 if($link === false){
    die("ERROR: Could not connect. " . mysqli_connect_error());
}
?>

What I get is:

123321Submit clicked
Warning: mysqli_stmt::bind_param(): Number of elements in type definition string doesn't match number of bind variables in D:\Apps\XAMPP\htdocs\StefanMath - Copy\LoginAuthenticate.php on line 22
Unsuccessful



Keep in mind that 123321 is the dummy test and password.

What I have tried:

I have tried changing the number of the statements but it doesn't work.
Posted
Updated 23-Dec-19 3:17am

PHP
$query = "SELECT username, password, data FROM mathbglogin WHERE username = '$username' and password = '$password'";

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
 
Share this answer
 
The most likely cause is that the field $data is empty, as shown in the message that you echo on line 13. So do what Patrice T has already suggested and create a proper SQL statement that is not vulnerable to SQL injection. Create a proper hashed password, instead of storing it in clear text, and remove the reference to $data in your bind statement.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900