mysqli_bind_result($stmt, $page_id, $page_name);

while(mysqli_stmt_fetch($stmt))
{
echo $page_name;
}

but when I try it dynamically I have no luck:

$rows[] = &$page_id;
$rows[] = &$page_name;
call_user_func_array(array($stmt, ‘bind_result’), $rows);

while(mysqli_stmt_fetch($stmt))
{
echo $page_name;
}

I would apprciate any help to resolve this.

Thanks Paul.

Are prepared statements worth the trouble?

I dont think so, i have only seen ugly work arounds to get about this parameter and type passing issues. Code can fail if we have null values and types are assigned based on these, making it completely unreliable.

given this one is forced to use regular statements rather than prepared statements. In this case the question becomes, how does one minimize the threat of sql injection attacks without using prepared statements.

Any ideas?

or suggestions will be much appreciated….

Things start moving along much faster once Legal is involved. I bet your file will get to the top of “Jimmy”’s pile as soon as Legal calls.

P.S. Haven’t seen you in a while! How you doin’? Sounds like you’re rockin’ life (minus the tax trouble).
P.S.S. If you are still a Integration Analyst at Strong, I’m jealous cuz you have my dream job. :)