php - MySQLi prepared statement complains that "only variables should be passed by reference"

Question

Code:

$stmt->bind_param("s", md5($input['user'] . $config['salt']));

PHP Error Message:

Only variables should be passed by reference

I've been working on this project but I am stuck now. I am new to PHP. What to do?

Answer 1

Thanks for using MySQLi prepared statements! They're a pain, but it's worth it.

bind_param takes values by reference. It does this by looking at the variable you're passing and pointing at the innards directly.

In your call, you're returning the string result of a function call - md5 in this case. Because there's no variable involved, there are no innards to point to. PHP is whining about not being able to pass the data by reference as a result.

You will need to stick the result of the function call into a variable, then pass that variable into the bind instead.

BIG FAT WARNING! md5 is not a secure hash any longer, and should not be used to store passwords. When you get the chance, you should update to a better hash format, such as bcrypt, PBKDF2, scrypt, etc.