Universal query preparation function I've finally finished my universal query preparation function. Any suggestions on making it better? I feel it could use some tweaking, but am not sure how I would go about it.

Variable examples/explanation


$db - The database connection
$query - Example: $query = "SELECT * FROM users WHEREusername=?"
$operation - The operation you wish to perform (number of rows, insert data)
$type - The variable types in mysqli_stmt_bind_param (example: $type = "ssi")
$variables - The variables to replace the question marks with




function manipulate($db, $query, $operation, $type, $variables)
{
    //Check Number of Variables inputted
    $numVars = (int)strlen($type);
    //Seperate variables into an array
    $var = explode(",",$variables);

    //Handle Statement
    $stmt = mysqli_stmt_init($db);
    if(mysqli_stmt_prepare($stmt, $query)) {
        echo "&lt;br /&gt; QUERY PREPARED &lt;br /&gt;";
        $x = 0;
        if( $numVars == 1 ) {
            mysqli_stmt_bind_param($stmt, $type, $var[0]);
        } else if ( $numVars == 2 ) {
            mysqli_stmt_bind_param($stmt, $type, $var[0], $var[1]);
        } else if ( $numVars == 3 ) {
            mysqli_stmt_bind_param($stmt, $type, $var[0], $var[1], $var[2]);
        } else if ( $numVars == 4 ) {
            mysqli_stmt_bind_param($stmt, $type, $var[0], $var[1], $var[2], $var[3]);
        } else if ( $numVars == 5 ) {
            mysqli_stmt_bind_param($stmt, $type, $var[0], $var[1], $var[2], $var[3], $var[4]);
        }

        mysqli_stmt_execute($stmt);
        mysqli_stmt_store_result($stmt);

        if($operation == "numRows" || $operation == "num_rows") {
            $output = mysqli_stmt_num_rows($stmt);
        } else {
            echo "Operation not supported";
        }

        mysqli_stmt_close($stmt);
        return $output;

    } else {
        echo mysqli_stmt_error($stmt);
        echo "&lt;br /&gt; QUERY DENIED &lt;br /&gt;";
    }
}
This is going to sound a bit harsh, but I don't see a purpose to this function.  It offers a tiny bit of a shortcut, but it cripples a lot of functionality to do so.


I'm not very familiar with MySQLi (PDO seems to have a lot more advantages than MySQLi and only a few, insignificant disadvantages -- though PDO does not have a procedural API like MySQLi does), but it seems like the only thing this function ever returns is the number of rows?  So this is a glorified num_rows() function?

debugging output should be removed, and errors should either be returned or thrown as exception.  Directly printing errors is bad since the calling code then doesn't know that an error occurred.
$variables is a blatant anti pattern.  If you want an array, use an array.  What if one of your bindings needs to have a comma in it?
What if numVars is >= 6? Doesn't seem very flexible.


If you decide to keep this function, use call_user_func_array to handle a dynamic amount of parameters.

Supporting numRows and numRows would probably come back to be a pain.  I'd stick with one or the other.  


Or, better yet, use constants like MANIPULATE_OP_NUMROWS (like built in functions do).

manipulate is a vague name.  Manipulate what?  And manipulate how?
(int)strlen($type); strlen already returns an int.  (And even if it didn't, you're using loose comparisons anyway.)