Php 使用mySQL prepared语句选择多个列

这将成功地从表中检索数据，但不使用mySQL准备的语句

$sql = "SELECT email, created_at, firstname, lastname FROM users WHERE id ='" . $_SESSION['id'] . "'";
$result = mysqli_query($link, $sql);

if (mysqli_num_rows($result) > 0) {
    // output data of each row
    while($row = mysqli_fetch_assoc($result)) {
        $email_address = $row["email"];
        $creatiom_time = $row["created_at"];
        $fname = $row["firstname"];
        $lname = $row["lastname"];
    }
}

如何将其转换为准备好的语句以防止SQL注入？我的转换尝试无法检索数据

$stmt = mysqli_prepare($link, "SELECT email, created_at, firstname, lastname FROM users WHERE id=?");
$stmt->bind_param("i", $_SESSION['id']);
$stmt->execute();
$stmt->bind_result($email_address, $creatiom_time, $fname, $lname);
$stmt->close();

---

我做错了什么？该电子邮件是唯一的，因此只能返回一行；但是，当我使用上述准备好的语句时，不会返回任何内容。多谢各位

您需要将行数据实际存储到绑定的结果变量中：

请注意，您确实应该检查这些调用的返回状态，特别是

准备

、

执行

和

获取

$stmt = mysqli_prepare($link, "SELECT email, created_at, firstname, lastname FROM users WHERE id=?");
$stmt->bind_param("i", $_SESSION['id']);
$stmt->execute();
$stmt->bind_result($email_address, $creatiom_time, $fname, $lname);
$stmt->fetch();
$stmt->close();
echo $email_address; // etc.