Calling prepare with mysqli - SQL syntax error

Question

$q2 = "UPDATE `tasks` SET `title` = ?, task = ?, rules = ?, media = ?, type = ?, xp = ?, available = ?, timestamp = ? WHERE id = ?";
            if ($stmt = $mysqli->prepare($q2)) {
                $stmt->bind_param("sssssissi", $_POST["tasktitle"], $_POST["editor"], $_POST["rules"], serialize($_POST["media"]), $_POST["type"], $_POST["xp"], $a = 0, strtotime("now"), $_GET['id']);
                $stmt->execute();
                $stmt->close();
            }
            $r = $mysqli->query($q2) or die($mysqli->error);

I got this error msg:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '?, task = ?, rules = ?, media = ?, type = ?, xp = ?, available = ?, timestamp = ' at line 1

What is problem, and how can i solve it?

Answer 1

I'm pretty certain it's coming from the call to $mysqli->query() which needs a properly escaped query (ie, none of that nice safe parameter stuff). That explains why it's complaining at the first ?.

Quick way to check is to actually comment out the entire if statement and se if the error still appears. If so, you know it's the query rather than the prepared statement execution.

My question to you is: why are you executing the prepared statement and then trying to run it again as a query?

I think you'll find the execute does your update quite well enough. Get rid of the call to query and you should be fine.