Return row count from mysqli prepared statement I want to know if it is okay/safe to use a prepared statement and mysqli_num_rows like this:
public function getUnreadNumber() {
    $userLoggedIn = $this-&gt;user_obj-&gt;getUsername();

    // get_result for * and bind for select columns
    // bind_result Doesn't work with SQL query that use *
    $query = $this-&gt;con-&gt;prepare('SELECT * FROM notifications WHERE viewed=&quot;0&quot; AND user_to = ? ');
    $query-&gt;bind_param(&quot;s&quot;, $userLoggedIn);
    $query-&gt;execute();
    $query_result = $query-&gt;get_result();

    return mysqli_num_rows($query_result);
}

Or should I do this?
$query = $this-&gt;con-&gt;prepare('SELECT * FROM notifications WHERE viewed=&quot;0&quot; AND user_to = ? ');
$query-&gt;bind_param(&quot;s&quot;, $userLoggedIn);
$query-&gt;execute();
$query_result = $query-&gt;get_result();
$numRows = $query_result-&gt;num_rows;

return $numRows;
You should definitely not be mixing procedural and object-oriented syntax.
Although it works with un-mixed syntax, the process is working harder than it needs to and delivering more result set data than you intend to use.
I would add COUNT(1) or COUNT(*) to the sql like this:
$sql = &quot;SELECT COUNT(1) FROM notifications WHERE viewed='0' AND user_to = ?&quot;;
$query = $this-&gt;con-&gt;prepare($sql);
$query-&gt;bind_param(&quot;s&quot;, $userLoggedIn);
$query-&gt;execute();
$query-&gt;bind_result($count);
$query-&gt;fetch();
return $count;

Assuming the sql is not broken due to syntax errors, this will always return a number.