title: How to use mysqli prepare statement to login with email or username (Not PDO)?
body: <p>I have saw many answer about php login with username or email, but I can't find the resolution of "Mysqli Prepare Statement", all of them used PDO...</p>
  
  <p>My question is, why I can't use two <code>?</code> to select username or email? </p>
  
  <p>My code is here:</p>
  
  <p>Database</p>
  
  <pre><code>table user
  --id int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
  --username varchar(20),
  --password varchar(255),
  --email varchar(30),
  </code></pre>
  
  <p>html</p>
  
  <pre><code>&lt;form action="login.php" id="login_form" method="post"&gt;
      &lt;input type="text" name="account" placeholder="username or email" /&gt;
      &lt;input type="password" name="password" placeholder="password" /&gt;
      &lt;div class="login_submit"&gt;
        &lt;button type="submit" name="submit"&gt;Login&lt;/button&gt;
      &lt;/div&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>PHP</p>
  
  <pre><code>&lt;?php
  $con = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME, DB_PORT);
  $con-&gt;query('SET CHARACTER SET utf8');
  
  if (isset($_POST['submit'])) {
      $account = $_POST['account'];
      $get_password = $_POST['password'];
      $login_query = 'SELECT username,password,email FROM user WHERE username = ? OR email = ?';
      $login_stmt = $con-&gt;stmt_init();
  
      if ($login_stmt-&gt;prepare($login_query)) {
          $login_stmt-&gt;bind_param('ss', $account, $account);
          $login_stmt-&gt;execute();
          $login_stmt-&gt;bind_result($username, $password, $email);
          $login_result = $login_stmt-&gt;get_result();
          while ($login_row = $login_result-&gt;fetch_assoc()) {
              $check_password = $login_row['password'];
          }
      } else {
          echo 'Login Error';
          exit();
      }
  
  if ($login_result-&gt;num_rows == 0) {
      $account_error = $lang_account_not_exist;
      $login_permit = false;
  } elseif (!password_verify($get_password, $check_password)) {
      $password_error = $lang_wrong_password;
      $login_permit = false;
  }
  </code></pre>
  
  <p><strong>EDIT</strong></p>
  
  <pre><code>bind_result($username, $password, $email);
  </code></pre>