php - T_OBJECT_OPERATOR 尝试将数据插入到 mySQL 数据中

Question

试图将代码输入到 sqldatabase...我在这里缺少什么？解析错误：语法错误，意外的 T_OBJECT_OPERATOR

<?php
$name = "";
$email = "";
$msg_to_user = "";
if ($_POST['name'] != "") {

    require_once("storescripts/connect_to_mysqli.php");

    // Be sure to filter this data to deter SQL injection, filter before querying database
    $name = $_POST['name'];
    $email = $_POST['email'];
    $sqlCommand = "SELECT * FROM newsletter WHERE email='$email'";
    $sql = mysqli_query($myConnection,$sqlCommand);
    $numRows = mysqli_num_rows($sql);
        if (!$email) {

        $msg_to_user = '<br /><br /><h4><font color="FF0000">Please type an email address ' . $name . '.</font></h4>';
    } else if ($numRows > 0) {
        $msg_to_user = '<br /><br /><h4><font color="FF0000">' . $email . ' is already in the system.</font></h4>';

    } else {
        $sqlCommand="INSERT INTO newsletter (name, email, dateTime)                                                     VALUES(?,?,NOW() )";
$stmt= $myConnection->prepare($sqlCommand);
$stmt=->bind_param('ss',$name,$email);
$stmt->execute();
    $msg_to_user = '<br /><br /><h4><font color="0066FF">Thanks ' . $name . ', you have been added successfully.</font></h4>';
        $name = "";
        $email = "";
    }
}
?>

Answer 1

你有这个代码：

$stmt=->bind_param('ss',$name,$email);

应该是这样的：

$stmt->bind_param('ss',$name,$email);

---

进一步的（不相关的）建议：

• 使用参数化查询修复 SQL 注入漏洞。请参阅如何防止 PHP 中的 SQL 注入？
• 正确且一致地缩进您的代码以防止不可读。