SRL Archive - Web Development

I am using MySQLi for some database handling and I don't understand why my code isn't working. This is really my first time using prepared statements, but it would be beneficial for me in this particular situation.
[PHP]// new connection
$mysqli = new mysqli(
$config['database']['connect']['host'],
$config['database']['connect']['username'],
$config['database']['connect']['password'],
$config['database']['connect']['name']
);

// verify connection
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}

// create prepared statement
if ($stmt = $mysqli->prepare('SELECT password FROM login_users WHERE user_name = ? LIMIT 1')) {
$stmt->bind_param('s', $username);

$username = 'gooduser';
$password = md5('goodpass');

$stmt->execute();
$stmt->store_result();

$_SESSION['messages'][] = 'Num rows: ' . $stmt->num_rows;

$stmt->bind_result($pass);

$_SESSION['messages'][] = 'Line 67';
while ($stmt->fetch()) {
$_SESSION['messages'][] = 'Line 69';
if ($password == $pass) {
$_SESSION['messages'][] = 'Success!';
}
else {
$_SESSION['messages'][] = 'Bad pass';
}
}
$_SESSION['messages'][] = 'Line 77';
header('Location: ' . $_SESSION['redirect']);

$stmt->close();
}
$mysqli->close();
[/PHP]With a username of "gooduser" and "goodpass", this should return the correct row and it should work from there. Note that $_SESSION['messages'] is my message tracker. When outputting the messages, I get this output:

Num rows: 0
Line 67
Line 77

It is skipping the while-loop because Num rows is 0. When changing the snippet by the query to not use bound params, it works:
[PHP]// create prepared statement
if ($stmt = $mysqli->prepare('SELECT password FROM login_users WHERE user_name = "gooduser" LIMIT 1')) {
//$stmt->bind_param('s', $username);

//$username = 'gooduser';
$password = md5('goodpass');
[/PHP]This returns, as intended:

Num rows: 1
Line 67
Line 69
Success!
Line 77

Anyone care to explain what I am doing wrong here? I am attempting to make a simple login script and I am (clearly) failing at it.
Here is the table structure:

CREATE TABLE `login_users` (
  `user_id` int(11) NOT NULL auto_increment,
  `user_name` varchar(30) NOT NULL default '',
  `password` varchar(70) NOT NULL default '',
  PRIMARY KEY  (`user_id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;

I don't know much PHP, but it looks like you're calling $stmt->bind_param('s', $username); before setting $username. Would that cause a problem?

Actually I've tried both before and after (like in the example I provided). Aside from that, almost every example I have seen does it this way. Also considering PHP variables can be initiated just by calling them anywhere in a script (for the most part);

The order I see other scripts is this:
[PHP]
$stmt->bind_param('s', $username);

$username = 'gooduser';
$stmt->execute();

// handle row here

$username = 'otheruser';
$stmt->execute();

// handle other row here
[/PHP]

The example you provided only calls $stmt->bind_param('s', $username); when $username is assigned after it. The other one has the username passed directly as a value to the statement. If you have moved the assignment to $username before that call and it still doesn't work, I'm not sure what to tell you.

See Example #1 on php's site: http://www.php.net/manual/en/mysqli-stmt.bind-param.php

According to that example, I'm doing this correct and yet it still isn't working.

This seems to be an issue with my server. I just tried on a local database (WAMP setup), as well as another remote server and both works.

Code is fine, server is not.