Prepared statements

<?php
$con = mysqli_connect('localhost', 'root', '', 'books');

// ? - placeholders
$sql = 'SELECT * FROM users WHERE user_name=? AND user_pass =?';
$sql2 = 'INSERT INTO users () VALUES (?,?)';

$stmt = mysqli_prepare($con, $sql);
if($stmt){
    echo 'sql is OK';
}
//bind params to placeholders
//second param - data type first letter e.g. string 's', integer 'i' for each param
mysqli_stmt_bind_param($stmt,'ss',$_POST['user'], $POST['pass']);//
mysqli_stmt_execute($stmt);

// bind query result to variable for each column
//mysqli_stmt_bind_result($stmt, $user_id);
//take result
//while(mysql_stmt_fetch($stmt)){
    //echo $user_id;
//};

///dynamically create bind params
//gives metadata for column count etc.
$rows = mysqli_stmt_result_metadata($stmt);
while($field = mysqli_fetch_field($rows)){
    // collection of column names
    // values will be stored by reference $stmt->bind_result() in $row array
    $fields[] = &$row[$field->name];
}
//call function of object -> array($stmt, 'mysqli_stmt_bind_result') $stmt->bind_result()
//call function with params from array
call_user_func_array(array($stmt, 'bind_result'), $fields);
while(mysqli_stmt_fetch($stmt)){
    //results column_name -> value
    print_r($row);
};