Calling mysql from PDO returns error unknown field?

[samvb]

I been staring and editing the codes for hours...I cant seem to understand it at all. I want to login basically. I have a mysql stored procedure in this way:

CREATE DEFINER=`dan78`@`localhost` PROCEDURE `spLogMeIn`(IN uname varchar(12), IN upwd varchar(40))
BEGIN
SELECT memberid,memstatus,mememail,avatarname FROM tblmembers WHERE memuname=uname AND mempwd=upwd;
END
 

PHP: db.php

  public function runSelectQuery($sql) {
       try {
        $q = $this->conn->prepare($sql);
        $q->execute();
        return $row = $q->fetchAll();
        }
        catch (PDOException $e){
        return $e->getCode();
        }
    }
 
 

and now the login.php

require(DBFILE);
 
$mydb = new dbACW();
$result = $mydb->runSelectQuery("CALL spLogMeIn($uname,$upwd);");
 

The error code it returns is Unknown field name $username i.e. if i enter samsam for username it would be Unknown fieldname samsam in the fieldlist.

I have other stored procedures that are similar and work awesome. What am i doing wrong?

[Luuk]

quoot: "The error code it returns is Unknown field name $username"

In your code there is no $username..... ?

[samvb]

dude...$username is just a placeholder. wat ever is in it (e.g if i entere sam as username), error would be "unknown field sam in field list)

[Dormilich]

dude...$username is just a placeholder.

that’s your intention but to SQL you indeed give it as field name.

[samvb]

I think i am not clear...look at the mysql code

SELECT * FROM TBL WHERE FIELDNAME=parameter;

i send parameter from php. but it says parameter is unknown field. parameter is a value to compare against the field FIELDNAME..

[Rabbit]

Your stored procedure call doesn't delimit your parameters as strings

[samvb]

I actually solved after a while...i still dont know why others work but it doesnt. I just declared a variable to store the sql statement, prepare it then execute it.

[Dormilich]

you prepare it with the values already in the Statement, so it shouldn’t be called a proper prepared statement.