Preparing SQL query

Question

In my PHP document, I got a SQL query looking like this:

if(isset($_GET['id']))
{
    $id = $_GET['id'];
    $q = "SELECT * FROM `objekt_t` WHERE `id`='" . $id . "'";
    $row = mysqli_query($con, $q) or die(mysqli_error($con));
    while($r = mysqli_fetch_assoc($row))
    {
        $objekt = $r;
    }
}

I realize this is very unsafe practice concerning SQL injections and such, so I've been looking into prepared SQL querys, using bound parameters. Looking at bobby-tables.com I see this example query:

$stmt = $db->prepare('update people set name = ? where id = ?');
$stmt->bind_param('si',$name,$id);
$stmt->execute();

I do not understand how I should modify my current query to match the safer one using bound parameters. Any help is appreciated.

Answer 1

Just the same way

$mysqli = new mysqli("localhost", "my_user", "my_password", "db");

if(isset($_GET['id']))
{
    $id = $_GET['id'];
    $q = "SELECT some_field FROM `objekt_t` WHERE `id`= ?";

    if ($stmt = $mysqli->prepare($q)) {    
        $stmt->bind_param("i", $id);
        $stmt->execute();
        $stmt->bind_result($result);
        $stmt->fetch();
    }
}

Now $result variable contains the resuts of your query.