title: Uncaught Error: Call to a member function execute() on string
body: <p>I am trying to use PDO to transcribe my code from mysqli.</p>
  
  <p>I am making a simple low to high and vice-versa price filter</p>
  
  <p>Inside <strong><a href="https://pastebin.com/s7Fgrw79" rel="nofollow noreferrer">preview.php</a></strong> I have a form with radio check buttons that are send to by <code>POST</code> method into <em>search.php</em> file</p>
  
  <p>What I tried in <strong>search.php</strong> where Validating occurs:</p>
  
  <pre><code>  $sql =  "SELECT * FROM products";
        $cat_id = (($_POST['cat']!= '')?sanitize($_POST['cat']):'');
        if($cat_id == ''){
          $sql .= ' WHERE deleted = 0';
        }else{
          $sql .= "WHERE categories = '{$cat_id}' AND DELETED = 0";
        }
        $price_sort =(($_POST['price_sort'] != '')?sanitize($_POST['price_sort']):'');
        $min_price =(($_POST['min_price'] != '')?sanitize($_POST['min_price']):'');
        $max_price =(($_POST['max_price'] != '')?sanitize($_POST['max_price']):'');
  
        if($min_price != ''){
          $sql .= " AND price &gt;= '{$min_price}'";
        }
  
        if($max_price != ''){
          $sql .= " AND price &lt;= '{$max_price}'";
        }
  
        if($price_sort == 'low'){
          $sql .= " ORDER BY price";
        }
  
        if($price_sort == 'high'){
          $sql .= "ORDER BY price DESC";
        }
        $sql-&gt;execute();
  </code></pre>
  
  <p>This is returning </p>
  
  <blockquote>
    <p>Uncaught Error: Call to a member function execute() on a string</p>
  </blockquote>
  
  <p>Error occurs where on <code>execute</code>, I have tried using prepared statements and binding but I didn't find the solution</p>
  
  <hr>
  
  <p>Thanks to @Chris and @Cobra_Fast I managed to resolve my full issue by doing: </p>
  
  <ol>
  <li>Making sure my PDO object is preparing the statement</li>
  <li>Binding all the parameters (escaping having variable inside query statement)</li>
  </ol>
  
  <p><br></p>
  
  <pre><code>  $sql =  "SELECT * FROM products";
    $cat_id = (($_POST['cat']!= '')?sanitize($_POST['cat']):'');
    if($cat_id == ''){
      $sql .= ' WHERE deleted = 0';
    }else{
      // $sql .= "WHERE categories = '{$cat_id}' AND DELETED = 0";
      $sql .= "WHERE categories = :cat_id AND DELETED = 0";
    }
    $price_sort =(($_POST['price_sort'] != '')?sanitize($_POST['price_sort']):'');
    $min_price =(($_POST['min_price'] != '')?sanitize($_POST['min_price']):'');
    $max_price =(($_POST['max_price'] != '')?sanitize($_POST['max_price']):'');
  
    if($min_price != ''){
      $sql .= " AND price &gt;= :min_price";
      $sql-&gt;bindParam( ":max_price", $min_price, PDO::PARAM_STR );
  
    }
  
    if($max_price != ''){
      $sql .= " AND price &lt;= :max_price";
      $sql-&gt;bindParam( ":max_price", $max_price, PDO::PARAM_STR );
  
    }
  
    if($price_sort == 'low'){
      $sql .= " ORDER BY price";
    }
    if($price_sort == 'high'){
      $sql .= " ORDER BY price DESC";
    }
  
  
    // $veza-&gt;query($sql);
    $productQ =$veza-&gt;prepare($sql);
    $productQ-&gt;bindParam( ":cat_id", $cat_id, PDO::PARAM_STR );
    $productQ-&gt;execute();
  </code></pre>