Prepared statements in PHP for MySQL, what am I doing wrong?
<p>Previously in the soon-to-be-deprecated normal mysql functions, I had:</p>

<pre><code>    // On first connect to database, create a user to hold data for users not logged in
    if (mysql_num_rows(mysql_query("SELECT id FROM users WHERE id=1")) === 0) {
        mysql_query("INSERT INTO users(id,username,email,password) VALUES(1,'anonymous','anonymous','" . password_hash("noidentity", PASSWORD_BCRYPT) . "')");
    }
</code></pre>

<p>This is what I have now, trying to accomplish the same thing:</p>

<pre><code>    // On first connect to database, create a user to hold data for users not logged in
    $stmt = $db-&gt;prepare("SELECT id FROM users WHERE id = ?");
    $stmt-&gt;execute(1);
    $stmt-&gt;store_result();
    if ($stmt-&gt;num_rows == 0) {
        $stmt = $db-&gt;prepare("INSERT INTO users (id, username, email, password) VALUES (?, ?, ?, ?)");
        $stmt-&gt;execute(1, 'anonymous', 'anonymous', password_hash("noidentity", PASSWORD_BCRYPT));
    }
</code></pre>

<p>I keep getting the error "Warning: mysqli_stmt::execute() expects exactly 0 parameters, 1 given" where seemingly it expects 1, as I have 1 question mark, but I'm obviously doing something wrong.</p>

<p>Am I doing it right for the following ones?</p>

<pre><code>$stmt = $db-&gt;prepare("UPDATE users SET wins = wins + 1 WHERE id = ?");
$stmt-&gt;execute($_SESSION["id"]);
</code></pre>

<p>Should I have ? for the wins = part? If so, how would I fill in that value later if it depends on the current one in there?</p>

<p>What about:</p>

<pre><code>$stmt = $db-&gt;prepare("SELECT id, username, password FROM users WHERE email = ?");
$stmt-&gt;execute($email);
$row = $stmt-&gt;fetch();

if (password_verify($password, $row["password"])) {
</code></pre>

<p>Am I doing it right there?</p>

<p>I'm just trying to grasp these prepared statements for security purposes and finding it a little difficult.</p>
