$con = new mysqli("localhost","root","","my_db");
$stmt = $con->prepare("INSERT INTO mytbl(name,dob,gen,dt) VALUES ('$name','$datepicker','$gen',now())");
$stmt->bind_param('issssi', $name, $datepicker, $gen);
$stmt->execute();
$newId = $stmt->id;
$stmt->close();
I've started doing this type of codes recently so I didn't really get these stuff "issssi" "sssdi". What are the uses of these things? Does it vary from statement to statement and how to bind that now()
in $stmt->bind_param
.
Reading the documentation might be a good start.
The characters define the types of the parameters. In this case you're giving more types than parameters, so it's wrong.
What's most wrong is that you're not using any parameters at all. You're still just putting the values of the variables as is into the SQL string and are vulnerable for injections and other problems.
There is no need to do anything to the now()
if you want the current timestamp. The server will handle it. If you want some other timestamp then you can make it into a bindable variable like the others.