title: Warning: mysqli::bind_param(): Number of variables doesn't match number of parameters in prepared statement when assigning variables dynamically
body: <p>I am currently looking at ways to use an API to connect and manage queries securely (SQL injection  mitigation), while trying to follow DRY guidelines. I use prepared statements to prevent SQL injections, but I am running into warnings when running the function that is called when an HTTP GET request is received:  </p>
  
  <blockquote>
    <p>Warning: mysqli::bind_param(): Number of variables doesn't match number of parameters in prepared statement...</p>
  </blockquote>
  
  <p>An then my query fails with:</p>
  
  <blockquote>
    <p>Error: Commands out of sync; you can't run this command now Errno 2014</p>
  </blockquote>
  
  <p>A simple google search provides me with this answer:</p>
  
  <blockquote>
    <p>If you get Commands out of sync; you can't run this command now in your client code, you are calling client functions in the wrong order.</p>
  </blockquote>
  
  <p>The warnings and error message only happens when there is more than one argument in the array.
  My mySQL query function is as follows:</p>
  
  <pre><code>    //set properties to values given by constructor params, 
      //open mysqli connection, etc..
  
      public function query_db_stmt($sql, $param)
      {
  
          $stmt = $this-&gt;connection-&gt;prepare($sql);
          for ($i = 1; $i &lt; count($param); ++$i)
          {
              $stmt-&gt;bind_param(($param[0][$i - 1]), $param[$i]);  
          }
  
          $stmt-&gt;execute();
  
          $result = $stmt-&gt;get_result();
  
          $stmt-&gt;close();
          return $result;
      } // do other stuff here, like close the sql connection in __destruct()...
  </code></pre>
  
  <p>And then I create the object and then invoke the query function like so:</p>
  
  <pre><code>$sql = 'SELECT ? FROM user WHERE id=?;';
  $result = $mysql_db-&gt;query_db_stmt($sql, array('si', '*', $this-&gt;args[0]));  
  </code></pre>
  
  <p>I am obviously doing something wrong, as I get these warnings, and a Err number 2014, but I cannot figure out what it is. Any help would be appreciated.</p>
  
  <h2>EDIT:</h2>
  
  <p>I now understand that I cannot use the column or table name as an prepared statement, but I still have a similar problem when using this code except with a HTTP PUT request:</p>
  
  <pre><code>    parse_str(file_get_contents("php://input"), $put_vars);
      $sql = 'INSERT INTO user (username, password, email, birth, sex) VALUES (?, ?, ?, ?, ?);';
      $mysql_db-&gt;query_db_stmt($sql, array('sssss', $put_vars['username'], password_hash($put_vars['password'], PASSWORD_DEFAULT), 
        $put_vars['email'], $put_vars['birth'], $put_vars['sex']));
  </code></pre>
  
  <p>Using curl, I run curl -X PUT <a href="http://localhost/r.php" rel="nofollow">http://localhost/r.php</a> -d username=foo -d password=boo -d email=test@gmail.com -d birthday=2015-08-13 -d sex=m</p>
  
  <p>And I get the same error 5 times:</p>
  
  <blockquote>
    <p>Warning: mysqli::bind_param(): Number of variables doesn't match number of parameters in prepared statement...</p>
  </blockquote>
  
  <p>As before, But no DB Query failed error. Any comments?</p>