Member Avatar for RonKevinT.Manuela

Errors:
1. Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens' in C:\wamp\www\SICS\includes\submitcategory.php on line 75
2. PDOException: SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens in C:\wamp\www\SICS\includes\submitcategory.php on line 75

<?php



    //if form has been submitted process it
    if(isset($_POST['submit'])){

        $_POST = array_map( 'stripslashes', $_POST );

        //collect form data
        extract($_POST);

        //very basic validation
        if($catTitle ==''){
            $error[] = 'Please enter the Category.';
        }

        if(!isset($error)){

            try {

                $catURL = slug($catTitle);

                //insert into database
                $stmt = $db->prepare('INSERT INTO category (catTitle,catURL) VALUES (:catTitle, :catURL)') ;
                $stmt->execute(array(':catTitle' => $catTitle,':catURL' => $catURL));

                //redirect to index page
                header('Location: categories.php');
                exit;

            } catch(PDOException $e) {
                echo $e->getMessage();
            }

        }

    }

    //check for any errors
    if(isset($error)){
        foreach($error as $error){
            echo '<p class="error">'.$error.'</p>';
        }
    }
?>
    <?php
     $query = 'SELECT fullname from members where idNUMBER="'.$_SESSION['idnumber'].'"';
                try {
                        $pdoStatement = $db->query($query);
                }
                    catch (PDOException $exception) {
                        // the query failed and debugging is enabled
                        echo "<p>There was an error in query: $query</p>";
                        echo $exception->getMessage();
                        $pdoStatement = false;
                    }
                    if ($pdoStatement) {
                        // the query was successful
                        // get the result (if any)
                        // fetchObject returns FALSE if there is no record
                    if ($recordObj = $pdoStatement->fetchObject()) {
                        $user=$recordObj->fullname;       


                $act= "Added a category";
                $addcat=$db->prepare('INSERT INTO userlog (Name, Datelog, Activity ) VALUES (:Name, :Datelog, Activity)') ;
                $addcat->execute(array(
                    ':Name' => $user,

                    ':Datelog' => date('Y-m-d H:i:s'),

                    ':Activity'=> $act  

                ));

}       
}
?>
  • 2 Contributors
  • 2 Replies
  • 2K Views
  • 24 Minutes Discussion Span
  • Latest Post Latest Post by RonKevinT.Manuela

Dani AI

Generated

is right: the HY093 comes from a mismatch between placeholders in the SQL and the keys you pass to execute(). In your second INSERT the third placeholder is missing a colon, so PDO sees only two tokens but you bind three values. Every named token in the SQL must have a matching key (and vice versa), otherwise execute() fails. See the PDO execute docs.

A minimal, corrected example for the log write could look like this (note the three named tokens and three bound keys):

$add = $db->prepare('INSERT INTO userlog (`Name`,`Datelog`,`Activity`)
                     VALUES (:name, :date, :activity)');
$add->execute([
    ':name'     => $user,
    ':date'     => date('Y-m-d H:i:s'),
    ':activity' => $act,
]);

If you ever get HY093 again, dump what PDO thinks your statement and params are during debugging: $add->debugDumpParams();. It will show the SQL, placeholders, and bound values, which makes off-by-one or typo issues obvious. Reference.

One more improvement: parameterize the SELECT that fetches the user instead of interpolating $_SESSION['idnumber']:

$who = $db->prepare('SELECT fullname FROM members WHERE idNUMBER = :id');
$who->execute([':id' => $_SESSION['idnumber']]);
$user = $who->fetchColumn();

Also consider enabling exception mode once on your PDO handle so database errors are easier to spot while developing: $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); Docs. And since prepared statements handle quoting, there is no need to add quotes around values yourself. They also help prevent SQL injection when you bind input. Prepared statements overview.

Last tip: you generally do not need to stripslashes form data anymore; magic quotes were removed long ago and related functions now always return false. Details.

Recommended Answers

All 2 Replies

Member Avatar for pritaeas

Missing : on line 67.

Member Avatar for RonKevinT.Manuela

oopss...hehe..thanks sensei

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.