Take the 2-minute tour ×

I have an existing MySQLi query:

$conn = dbConnect('query');
$galNumb = "SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project = {$project}";
$gNumb = $conn->query($galNumb);
$row = $gNumb->fetch_row();
$galTotal = $row[0];

This counts the number of galleries per project that match the value in the query string contained in $project.

It works perfect but is not secure compared to a prepared statement. I have been researching this for two days and can not learn how to write this statement as a prepared statement. Any and all help will be insanely appreciated.

UPDATE: I am flying by the seat of my pants here. I simply need to be shown how to code the above as a prepared statement. This sort of thing isn't resonating with my brain like learning PHP did and I'm just not getting any of this. The PHP manual is confusing and seems to be written for people who already understand PHP.

In short, I need a prepared statement version of the above code so that I can echo the result on the page. Currently, with what is in my DB, the number should be 3, and it consistently returns 1.

I wish I knew more so that I could better phrase my questions, but alas, I'm still learning. My apologies.

UPDATE 2: Based on suggestions and research, I have this query written, but it ALWAYS returns the value 1, regardless of what's actually in the database:

$galNumb = "SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project_part = ?";
$stmt = $conn->prepare($galNumb);
$stmt->bind_param('i', $project);
$gNumb = $stmt->execute();

Again, All I want to do is COUNT how many galleries are in each project. I know this should be simple but it isn't for me. There is currently 1 project in the DB with 3 galleries. The query should return 3.

share|improve this question
You could just escape $project. Also, in the query, {$project} should be in single quotes. –  G-Nugget Dec 6 '12 at 2:11
What have you tried? You just need to change $project to a placeholder (?) then call $conn->prepare($galNumb), bind the param and then execute - see php.net/manual/en/mysqli.prepare.php –  therefromhere Dec 6 '12 at 2:11
I haven't tried anything but reverse-engineering other code examples. I am stumped on this which is why I posted this here. –  wordman Dec 6 '12 at 2:40
add comment

2 Answers

up vote 0 down vote accepted

This is as simple as it gets. This will prepare a sql statement, execute it and fetch the first row.


// create the prepared statement
$stmt = $conn->prepare('SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project = ?');

// bind a variable to the statment
// the character denotes the type of the variable
// 's' for string
// 'i' for integer

// execute the query

// get the result variable
$result = $stmt->get_result();

// fetch the row
$row = $result->fetch_row();

if ($row) {
    echo "The count is " . $row[0]; 


The documentation is pretty straightforward. You have a code example at the bottom.


share|improve this answer
Michael, I did look at that link, but I have to say, the PHP manual is not written in novice-friendly lingo. It Always confuses me more than it helps. –  wordman Dec 6 '12 at 2:39
Have you solved your problem? I noticed that you asked the same question earlier in another post. –  Michael Dec 6 '12 at 2:53
Michael, ugh...last time I asked two questions in one thread I got a talking down to. So since my previous post did not yield anything to solve my problem, I decided to re-phrase things and try again. It's hard to know how to ask a question about something you know very little about. No, this has not been answered. –  wordman Dec 6 '12 at 3:14
I've updated the response now. Is this what you're looking for? –  Michael Dec 6 '12 at 3:27
Michael...I think we're heading in the right direction. However, I ger this error: Fatal error: Call to a member function prepare() on a non-object in /path/file.php on line 23 –  wordman Dec 6 '12 at 3:31
show 3 more comments
$stmt = $dbConnection->prepare('SELECT COUNT(pj_gallery_id) FROM pj_galleries WHERE project = ?');
$stmt->bind_param('s', $project);

share|improve this answer
add comment

Your Answer


