• You can use object-oriented style doing this:
  
  PHP Code

  
<?php 
$con->query($stmt); 

  But remember that you have to create the connection with the object MySQLi:
  
  PHP Code

  
<?php 
$con = new mysqli("localhost","user","pass","db_name"); 

  
  


• The second option is to add in this string:
  
  PHP Code

  
<?php 
if(!mysqli_query($stmt)) 

  That:
  
  PHP Code

  
<?php 
if(!mysqli_query($con,$stmt)) 


(Apr 3, 2019 03:50 PM)Jack Drake Wrote:  Thanks a lot, the issue was that I was missing a parameter from the query call, but I only figured it out through your guys' help.

My new problem is trying to understand the issue with inserting into a table in this database.

This is the code I have:

Code

<?php
   $con = new mysqli("localhost", "username", "password", "database");
   if($con->connect_error)
   {
       echo "failed to connect to the database.";
   }
   else
   {
   echo '<script>alert("success, connected to database");</script>';
   }
       $stmt = "insert into test (name text, num text) values ('name', 'last')";
        if($con->query($stmt) !== true)
       {
        echo $con->error;
       }
?>

The error I receive is this:

Code

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'text, num text) values ('name', 'last')' at line 1

What is the issue.

(Apr 3, 2019 04:04 PM)Jack Drake Wrote:  Is it true that preparing the statement actually decreasing the chance of SQL Injection?

(Apr 3, 2019 04:46 PM)Nachfolger Wrote:  Do you think that's just nazi-propaganda or something? Yes, using prepared/parameter statements with proper validation will absolutely decrease the chance of SQL injection.