CODEWITHSUNDEEP
phpmysqlpdoparameters
Vincent Li
Vincent Li

Reputation: 55

SQLSTATE[HY093]: Invalid parameter number (parameters not match)

SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens

I know there are several questions with the same problem out there. But I've checked all the answers and the problem still cannot be solved. Really hope anyone could help me out. Thank you so much!

session_start();
$cid = $_POST['cid'];
$pContent = $_POST['pContent'];
$sContent = $_POST['sContent'];

$insert = "INSERT INTO 'Card'('cardID', 'creator', 'primaryLanguage', 
          'secondaryLanguage', 'primaryContent', 'secondaryContent')
          VALUES (:cid, 'abc', 'English', 'Chinese', ':pContent', ':sContent')";
try {
  $stmt = $dbh->prepare($insert, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
  $stmt->bindValue(":cid", $cid, PDO::PARAM_INT);
  $stmt->bindValue(":pContent", $pContent, PDO::PARAM_STR);
  $stmt->bindValue(":sContent", $sContent, PDO::PARAM_STR);
  $stmt->execute();
  unset($stmt);
} catch (Exception $e) {
  echo 'Exception : ' . $e->getMessage() . "\n";
  die();
}

Upvotes: 0

Views: 88

Answers (2)

Abhik Chakraborty
Abhik Chakraborty

Reputation: 44874

Few mistakes in the query.

  • You do not need single quote for column names

  • Bind values for the place holder does not need the single quotes

So the query should be as

INSERT INTO 
Card(
cardID, 
creator, 
primaryLanguage, 
secondaryLanguage,
primaryContent, 
secondaryContent
)
VALUES 
(
:cid, 
'abc',
'English', 
'Chinese', 
:pContent, 
:sContent
);

Upvotes: 1

Gordon Linoff
Gordon Linoff

Reputation: 1271151

This is the proper syntax for your insert:

INSERT INTO Card(cardID, creator, primaryLanguage, 
                 secondaryLanguage, primaryContent, secondaryContent)
    VALUES (:cid, 'abc', 'English', 'Chinese', :pContent, :sContent)

You have way too many single quotes. Only use single quotes for string and date constants. You do not have to use them for parameters, because you declaring the parameter to be a string -- and MySQL is smart enough to know what a string is.

If you have to escape a column or table name, first consider renaming it, so quotes are not needed. But, if you have to, use backticks rather than single quotes.

Upvotes: 1

Related Questions