PHP - Trouble Inserting Post Data Into Pdo Prepared Statements

 I've had to rearrange a lot of code and I've been trying to put together a prepared statement in a registration form. I'm having a really hard time and being very new to PHP the issue is really confusing for me.

first, I have this function:

//PROCESS DB
function process_database($post) {
  global $table;
  global $conn;

  //THIS FUCKING THING IS DRIVING ME
  //check database connection
  if ($conn->connect_error) {
    return false;

  } else {
    if($statement = $conn->prepare("INSERT INTO $table (username, email, password) VALUES ( ?, ?, ? )")){
      
      $username = $post['username'];
      $email = $post['email'];
      $password = $post['password'];

      $statement->bind_param("sss", $username, $email, $password);

      $statement->execute();
      
      //DEBUGGING
      echo "Added: ".$username.", ".$email.", ".$password."<br>";

      if(!$statement->execute()){
        printf("Connect Failed: %s\n", $conn->connect_error);
      } else {
        echo 'fuckin ay!!!';
      }
      //END DEBUG BLOCK

    } else {
      return false;
    }
  }
  return true; 
}

The issue is very strange. I'll post the function call so it's clear:

//process database actions
  if (!process_database($data) ) {
    return array( 'status' => 0, 'message' => 'Unable to process database request' );
  }

When I run the registration.py without process_database() everything is fine, so I'm confident in the error processing. Here's where it get weird -

when I process the form

echo "Added: ".$username.", ".$email.", ".$password."<br>";

is returned from the //DEBUGGING BLOCK but I also get back the error from the following if statement - "Connection Failed: ...."

BUT I also get back the registration successful message that only shows if the function returns true

In short, it's giving me 2 positive affirmations but also the Connection failed message and of course it's not adding anything to the database. I've been working this function all day, and I'm lost for answers. What's going on with this code? I can't see where I've gone wrong

In lieu of prepared statements, will this work effectively?  Is it overkill?

$username = mysqli_real_escape_string($conn,$_POST["username"]);

	$username = strip_tags(trim($username));

Can I write it this way:

$username = mysqli_real_escape_string($conn,strip_tags(trim($_POST["username"])));

Are prepared statements a guarantee for defeating an injection attack?  Or should they be used in conjunction with the above (or other) coding to bolster a database's defenses?

Hello there

I'm really struggeling with my prepared statement. I want to get the number of unread PMs to show at the user's homepage. Can someone help me with some explanation about my code? I don't really know what I'm doing yet. I've read a lot of code about prepared statements, but I still can't figure it out. 

public function count_unread_pm() {
        if($stmt = $this->db->prepare("SELECT unread FROM pm WHERE unread=1")) {

            /* Bind parameters, s - string, b - blob, i - int, etc */
			$stmt->bindParam(':unread', $id, PDO::PARAM_INT); 
            $stmt -> execute();

            var_dump($stmt); // no output 

            /* Bind results */
            $stmt -> bind_result($test); // Error: call to undefined method 

            /* Fetch the value */
            $stmt -> fetch();
            $numberofrows = $stmt->num_rows;

            /* Close statement */
            $stmt -> close();
        }
        var_dump($numberofrows); // no output 

    }

I'm trying to use a prepared statement inside a function and it's giving me some trouble. I have an RPG game I'm working on an want a function to include on pages that tells a user to collect their egg from the professor if they haven't already received it yet. When I try to call the function on the page these are the errors I get:

Notice: Undefined variable: link in /home/evoarena/public_html/Dev/functions.php on line 23

Fatal error: Uncaught Error: Call to a member function prepare() on null in /home/evoarena/public_html/Dev/functions.php:23 Stack trace: #0 /home/evoarena/public_html/Dev/login.php(59): egg_received() #1 {main} thrown in /home/evoarena/public_html/Dev/functions.php on line 23

$link is defined in a db config file and on the page I'm trying to call the function I have the files required like this so I'm wondering why it still thinks link is an undefined variable 

require "config.php";
require "functions.php";

Function Code:

function egg_received () {

  if (isset($_SESSION['username'])) {
     
    $username = $_SESSION['username'];
    $query = "SELECT egg_received FROM users WHERE username=?";
    if ($stmt = $link->prepare($query)) {
    
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();
    
    $egg = $result->fetch_array();
    
    if ($egg['egg_received'] == '0') {
    
      echo "<div class='alert alert-primary' role='alert'>
      Oh well hello there! It appears the professor is looking for you today!<br><a href='../world/professor.php'>Visit the Professor</a>
      </div>";
      
      require "footer.php";
      exit;
      
    }

} else {
    
     $error = $link->errno . ' ' . $link->error;
    echo $error;
}
}
}

<?php

	try {
      
	  require_once '../includes/pdo_connect.php';
      $make = mysqli_real_escape_string($_GET['make']);
      $sql = 'SELECT *
                FROM cars
                WHERE make LIKE :make AND yearmade >= :yearmade AND price <= :price
                ORDER BY price';
        $stmt = $db->prepare($sql);
        $stmt->bindValue(':make', '%' . $make . '%');
        $stmt->bindParam(':yearmade', $_GET['yearmade'], PDO::PARAM_INT);
        $stmt->bindParam(':price', $_GET['price'], PDO::PARAM_INT);
        $stmt->execute();
        $errorInfo = $stmt->errorInfo();
        if (isset($errorInfo[2])) {
            $error = $errorInfo[2];
        }
    } catch (Exception $e) {
        $error = $e->getMessage();
    }

<?php
MAKING CONNECTION

if ($stmt = $mysqli->prepare("SELECT year FROM SOMETABLE WHERE id = ? LIMIT 1")) {

    $id = $_GET['id'];
    
    $stmt->bind_param("i", $id);
    
    
    $stmt->execute();
    
    
    $stmt->bind_result($year);
    
    $stmt->fetch();
    
    echo $year;
        
    
    $stmt->close();
}
$mysqli->close();

?>

The first piece of code, "screenshot_1", works perfectly but of course is open to SQL injection. If I use prepared statements as per "screenshot_2", and change $result from $con->query($query) to $result= $query->execute()it doesn't work and gives the error, "Fatal error: Uncaught Error: Call to a member function fetch() on bool ". I have read somewhere that this is caused because the 'Select' statement has failed.I am amazed that three lines of code (copied from a php manual) has caused the whole issue to fail. Where have I gone wrong?

,  

Hi, how do I use prepared statements when working with classes and functions? I need to do perform multiple identical inserts/updates to mySQL. I have been trying to implement into my connection class, based on what I have seen in examples I found on google. I keep getting fatal errors.

My code is (save.php)

<?php
//Class extends DB_connect to access database
class saveWorkout extends DB_Connect {
  // $stml->close();
  public function get_jQueryData($planned_workout_id,$array_input) {
    // loop through workout progress, and check if input already exists in database
    for ($i = 0; $i < count($array_input['field_id']); $i++) {
      if(empty($array_input['field_id'][$i])) {
        $planned_workout_id = $array_input['planned_id'][$i];
        $exercise_id = $array_input['exercise_id'][$i];
        $set_id = $array_input['set_id'][$i];
        $weight = $array_input['weight'][$i];
        $reps = $array_input['reps'][$i];
        $this->insertNewEntry->$stmt->execute();
      } // closing else
      else {
        // Do something
      } //closing else
    } // Closing for statement
  }

  protected function insertNewEntry() {
    $stmt = $this->$connect()->prepare("INSERT INTO Workout_Log (planned_workout_id, exercise_id, set_id, weight, reps, entry_date) VALUES ( ?, ?, ?, ?, ?, ?)");
    $stmt->bind_param($planned_workout_id, $exercise_id, $set_id, $weight, $reps, date("Y-m-d H:i:s"));
  }
} // closing class save_workout
?>

my connection file is looks like this (connect.php)

class DB_Connect {
  private $servername;
  private $username;
  private $password;
  private $dbname;

  protected function connect() {
    $this->servername = "localhost";
    $this->username = "root";
    $this->password = "XXXXXX";
    $this->dbname = "NNNNNNN";
    $conn = new mysqli($this->servername,$this->username,$this->password,$this->dbname);
    return $conn;
  }
};