PHP MySQLi mysqli_stmt_init() - Statement Initialization

mysqli_stmt_init()

The mysqli_stmt_init() function initializes a new statement and returns an object that can be used in the mysqli_stmt_prepare() function. This is a crucial step in writing secure code that prevents SQL injection.

EXAMPLE

<?php
$server = "localhost";
$username = "root";
$password = "";
$database = "mysqli_database";

$connection = mysqli_connect($server, $username, $password, $database);

if (mysqli_connect_errno()) {
    echo "Connection failed: " . mysqli_connect_error();
    exit();
}

$fruit = "Banana";

// 1. Initialize an empty prepared statement object
// NOTE: This function creates a secure communication channel between PHP and the MySQL server.
// From this moment on, the communication is split into two parts: we send the SQL command and the data separately.
$stmt = mysqli_stmt_init($connection);

// 2. Send the fixed SQL command structure with a question mark (placeholder) to the server
if (mysqli_stmt_prepare($stmt, "SELECT fruit FROM mysqli_table WHERE fruit=?")) {
    
    // 3. Bind the parameter ("s" means String) to the question mark
    mysqli_stmt_bind_param($stmt, "s", $fruit);
    
    // 4. Execute the secure query on the server
    mysqli_stmt_execute($stmt);
    
    // 5. Bind the result from the database to the PHP variable $output
    mysqli_stmt_bind_result($stmt, $output);
    
    // 6. Fetch the row value and display it
    mysqli_stmt_fetch($stmt);
    if ($output) {
        printf("%s is present in the table!", $output);
    } else {
        echo "The requested fruit is not in the table.";
    }
    
    // 7. Always close the statement when finished to free server memory
    mysqli_stmt_close($stmt);
}

mysqli_close($connection);
?>

RESULT

The result will be displayed here...

Practical use: Instead of executing an SQL statement directly, we first create an empty framework using mysqli_stmt_init(), prepare it with SQL code, and then securely bind it to data. This is standard procedure when developing professional applications.

Creates an empty prepared statement object.

Essential for use with procedural functions like mysqli_stmt_prepare().

Increases code clarity in complex queries.