title: Why Isn't my prepared statement working?
body: <p>So this works:</p>
  
  <pre><code>$name=mysqli_real_escape_string($conn,$_POST['name']);
  $password=mysqli_real_escape_string($conn,$_POST['password']);
  $sql= "SELECT password FROM Accounts WHERE username='$name';";
  $result= $conn-&gt;query($sql);
  $row=mysqli_fetch_assoc($result);
  </code></pre>
  
  <p>but this doesn't:</p>
  
  <pre><code>$name=mysqli_real_escape_string($conn,$_POST['name']);
  $password=mysqli_real_escape_string($conn,$_POST['password']);
  //$sql= "SELECT password FROM Accounts WHERE username='$name';";
  
  $stmt = $conn-&gt;prepare("SELECT password FROM Accounts WHERE username=?");
  $stmt-&gt;bind_param("s",$name);
  $stmt-&gt;execute();
  $result= $stmt-&gt;get_result();
  
  $row=mysqli_fetch_assoc($result);
  $stmt-&gt;close();
  </code></pre>
  
  <p>Why would the first one work, but not the second one? I have PHP 7 installed on my server. I wanna make input secure to avoid SQL injection, but prepared statements aren't working for some reason</p>
  
  <p>EDIT: so using bind_param() and fetch() fixed the problem for me. But I'm still curious why get_result() didn't work. Does get_result() provide just the value selected, whereas my old $result =query() returned the entire row?</p>
  
  <p>My guess is maybe the two methods return different types of data/formats?</p>