I've decided to move over to using Prepared statements for security purposes, however I'm having problems with the following code.
Any help or suggestions would be appreciated
Output:
You are Logged In
Fatal error: Call to a member function bindParam() on a non-object in [b]xxxxxxx[/b]/login.php on line 34
Code:
<?php
include "functions.php";
$db_connection = db_connect();
$db_connection2 = db_connect();
$login_statement = $db_connection->prepare("SELECT COUNT(*) AS accounts FROM `accounts` WHERE `email` = ? AND `password` = ?");
$test_stmt = $db_connection2->prepare("INSERT INTO `test` (`test`) VALUES (:tst)");
login($_POST[email],$_POST[password],$login_statement);
log_login($test_stmt);
function login($email,$password,$login_statement){
$login_statement->bind_param("ss", $email, $password);
$login_statement->bind_result($accounts);
$login_statement->execute() or die ("Could not execute statement");
while ($login_statement->fetch()) {
if ($accounts==1){
echo "<br/> You are Logged In <br/>";
}
else{
echo "<br/>Credentials Invalid<br/>";
}
}
}
function log_login($test_stmt){
$test_stmt->bindParam(':tst', $tst); //< ********LINE 34*******
$tst="blah";
$test_stmt->execute() or die ("Could not execute statement");
}
?>