<p>In a project that I'm about to wrap up, I've written and implemented an object-relational mapping solution for PHP. Before the doubters and dreamers cry out "how on earth?", relax -- I haven't found a way to make late static binding work -- I'm just working around it in the best way that I possibly can.</p>

<p>Anyway, I'm not currently using prepared statements for querying, because I couldn't come up with a way to pass a variable number of arguments to the <code>bind_params()</code> or <code>bind_result()</code> methods. </p>

<p>Why do I need to support a variable number of arguments, you ask? Because the superclass of my models (think of my solution as a hacked-up PHP ActiveRecord wannabe) is where the querying is defined, and so the find() method, for example, doesn't know how many parameters it would need to bind.</p>

<p>Now, I've already thought of building an argument list and passing a string to eval(), but I don't like that solution very much -- I'd rather just implement my own security checks and pass on statements.</p>

<p>Does anyone have any suggestions (or success stories) about how to get this done? If you can help me solve this first problem, perhaps we can tackle binding the result set (something I suspect will be more difficult, or at least more resource-intensive if it involves an initial query to determine table structure).</p>

[{'answer_id': 13092, 'author': 'John Downey', 'author_id': 200, 'author_profile': 'https://Stackoverflow.com/users/200', 'pm_score': 5, 'selected': True, 'text': '<p>In PHP you can pass a variable number of arguments to a function or method by using <a href="http://www.php.net/call_user_func_array" rel="noreferrer"><code>call_user_func_array</code></a>. An example for a method would be:</p>\n\n<pre><code>call_user_func_array(array(&amp;$stmt, \'bindparams\'), $array_of_params);\n</code></pre>\n\n<p>The function will be called with each member in the array passed as its own argument.</p>\n'}, {'answer_id': 80352, 'author': 'Steven Oxley', 'author_id': 3831, 'author_profile': 'https://Stackoverflow.com/users/3831', 'pm_score': 0, 'selected': False, 'text': '<p>I am not allowed to edit, but I believe in the code</p>\n\n<pre><code>call_user_func_array(array(&amp;$stmt, \'bindparams\'), $array_of_params);\n</code></pre>\n\n<p>The reference in front of $stmt is not necessary.  Since <code>$stmt</code> is the object and <code>bindparams</code> is the method in that object, the reference is not necessary.  It should be:</p>\n\n<pre><code>call_user_func_array(array($stmt, \'bindparams\'), $array_of_params);\n</code></pre>\n\n<p>For more information, see the PHP manual on <a href="http://au2.php.net/manual/en/language.pseudo-types.php#language.types.callback" rel="nofollow noreferrer">Callback Functions</a>."  </p>\n'}, {'answer_id': 2575732, 'author': 'jsleuth', 'author_id': 275700, 'author_profile': 'https://Stackoverflow.com/users/275700', 'pm_score': 0, 'selected': False, 'text': '<pre><code>call_user_func_array(array(&amp;$stmt, \'bindparams\'), $array_of_params);\n</code></pre>\n\n<p>Didn\'t work for me in my environment but this answer set me on the right track.  What actually worked was:</p>\n\n<pre><code>$sitesql = \'\';\n$array_of_params = array();\nforeach($_POST[\'multiselect\'] as $value){\n    if($sitesql!=\'\'){\n        $sitesql .= "OR siteID=? ";\n        $array_of_params[0] .= \'i\';\n        $array_of_params[] = $value;\n    }else{\n        $sitesql = " siteID=? ";\n        $array_of_params[0] .= \'i\';\n        $array_of_params[] = $value;\n    }\n}\n\n$stmt = $linki-&gt;prepare("SELECT IFNULL(SUM(hours),0) FROM table WHERE ".$sitesql." AND week!=\'0000-00-00\'");\ncall_user_func_array(array(&amp;$stmt, \'bind_param\'), $array_of_params);\n$stmt-&gt;execute();\n</code></pre>\n'}, {'answer_id': 7240875, 'author': 'zhikharev', 'author_id': 919105, 'author_profile': 'https://Stackoverflow.com/users/919105', 'pm_score': 1, 'selected': False, 'text': '<p>You\'ve got to make sure that $array_of_params is array of <strong>links to variables</strong>, not values themselves. Should be:</p>\n\n<pre><code>$array_of_params[0] = &amp;$param_string; //link to variable that stores types\n</code></pre>\n\n<p>And then...</p>\n\n<pre><code>$param_string .= "i";\n$user_id_var = $_GET[\'user_id\'];//\n$array_of_params[] = &amp;$user_id_var; //link to variable that stores value\n</code></pre>\n\n<p>Otherwise (if it is array of values) you\'ll get:</p>\n\n<blockquote>\n  <p>PHP Warning:  Parameter 2 to mysqli_stmt::bind_param() expected to be a reference</p>\n</blockquote>\n\n<hr>\n\n<p>One more example:</p>\n\n<pre><code>$bind_names[] = implode($types); //putting types of parameters in a string\nfor ($i = 0; $i &lt; count($params); $i++)\n{\n   $bind_name = \'bind\'.$i; //generate a name for variable bind1, bind2, bind3...\n   $$bind_name = $params[$i]; //create a variable with this name and put value in it\n   $bind_names[] = &amp; $$bind_name; //put a link to this variable in array\n}\n</code></pre>\n\n<p>and BOOOOOM:</p>\n\n<pre><code>call_user_func_array( array ($stmt, \'bind_param\'), $bind_names); \n</code></pre>\n'}, {'answer_id': 58364199, 'author': 'mickmackusa', 'author_id': 2943403, 'author_profile': 'https://Stackoverflow.com/users/2943403', 'pm_score': 2, 'selected': False, 'text': "<p>The more modern way to bind parameters dynamically is via the splat/spread operator (<code>...</code>).</p>\n<p>Assuming:</p>\n<ul>\n<li>you have a non-empty array of values to bind to your query and</li>\n<li>your array values are suitably processed as string type values in the context of the query and</li>\n<li>your input array is called <code>$values</code></li>\n</ul>\n<p>Code for PHP5.6 and higher:</p>\n<pre><code>$stmt-&gt;bind_param(str_repeat('s', count($values)), ...$values);\n</code></pre>\n<p>In fact, all of the arguments fed to <code>bind_param()</code> can be unpacked with the splat/spread operator if you wish -- the data types string just needs to be the first element of the array.</p>\n<pre><code>array_unshift($values, str_repeat('s', count($values)));\n$stmt-&gt;bind_param(...$values);\n</code></pre>\n"}]
['https://Stackoverflow.com/questions/12656', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1344/']