title: How can I add prepare statement in my comment printing system
body: <p>I'm currently building a system where users can write and read comments. So the comments will be inserted into database (the inserting part is already protected with the prepared statement), so now I want to add the prepared statement at the comment printing part too.</p>
  <p>This is the comment inserting part</p>
  <pre><code>&lt;?php
      if (isset($_POST['submit'])) {
      $nickname=$_POST['user_nickname'];
      $email=$_POST['user_email'];
      $comment=$_POST['cmt_text'];
      $course=$_POST['user_course'];
      $rating=$_POST['user_rating'];
      $classof=$_POST['user_classof'];
      $school_id=$_POST['id'];
      $db=&quot;INSERT INTO comments(user_nickname,user_email,cmt_text,user_course,user_rating,school_id,user_classof) VALUES(?,?,?,?,?,?,?)&quot;;
      $stmt=mysqli_stmt_init($con);
      if(!mysqli_stmt_prepare($stmt,$db)){
          echo &quot;Data Error&quot;;
      }else{
          mysqli_stmt_bind_param($stmt,&quot;ssssiii&quot;, $nickname,$email,$comment,$course,$rating,$school_id,$classof);
          mysqli_stmt_execute($stmt);
      }
      header(&quot;location:Done.php&quot;);
      exit;
      }?&gt;
  </code></pre>
  <p>And this is where I want to add prepared statements</p>
  <pre><code>&lt;?php 
      $sql = &quot;SELECT * FROM comments WHERE school_id=$sid ORDER BY Datetime DESC &quot;;
      $result = mysqli_query($con, $sql);
      if (mysqli_num_rows($result) &gt; 0) {
      while ($row = mysqli_fetch_assoc($result)) {
      ?&gt;
          &lt;div class=&quot;single-item&quot;&gt;
              &lt;h4&gt;&lt;?php echo $row['user_nickname'];   ?&gt;&lt;/h4&gt;
              &lt;p&gt;&lt;?php echo $row['Datetime']; 
              ?&gt;&lt;/p&gt;
              &lt;p&gt;&lt;b&gt;Course&lt;/b&gt; : &lt;?php echo $row['user_course']; 
              ?&gt;&lt;/p&gt;
              &lt;p&gt;&lt;b&gt;Class of&lt;/b&gt; &lt;?php echo $row['user_classof']; 
              ?&gt;&lt;/b&gt;&lt;/p&gt;
              &lt;p&gt;&lt;b&gt;Rating : &lt;/b&gt;&lt;?php echo $row['user_rating']; 
              ?&gt;/5&lt;/p&gt;
              &lt;p&gt;&lt;b&gt;Comment : &lt;/b&gt;&lt;?php echo $row['cmt_text']; 
              ?&gt;&lt;/p&gt;
          &lt;/div&gt;
          &lt;?php
              }
          }
  ?&gt;
  </code></pre>
  <p>I have tried adding, but I got stuck when it comes to the part where I need to put the parameter, since I am printing out all the comments, how can I add the <code>?</code> parameter?</p>
  <p>By the way,<code> $sid</code> is a specific id for one school. There's more than a hundred schools in the<code>comments </code> table. I put all the comments from every schools in one table.</p>