Strict Standards: Only variables should be passed

Question

I am working on a login system for a project using MVC programming and ran into this error. Here is the code, the problem line is #31

This login system is a tutorial, I have been working through it exactly as is. I've read there are some version issues with PHP 5? Not sure, hopefully somebody could assist me.

Problem line:

$stmt->bind_param("ss", $user, md5($pass . $this->salt));

Code:

<?php

/*
    Authorization Class
    deal with auth tasks
*/

class Auth
{
private $salt = 'j4H9?s0d';

/*
    Constructor
*/
function __construct()
{
}

/*
    Functions

*/
function validateLogin($user, $pass)
{
    // access db
    global $Database;

    // create query
    if ($stmt = $Database->prepare("SELECT * FROM users WHERE username = ? AND password = ?"))
    {
        $stmt->bind_param("ss", $user, md5($pass . $this->salt));
        $stmt->execute;
        $stmt->store_result();

        // check for num rows
        if ($stmt->num_rows > 0)
        {
            // success
            $stmt->close();
            return TRUE;
        }
        else
        {
            // failure
            $stmt->close();
            return FALSE;
        }
    }
    else
    {
        die("ERROR: Could not prepare MySQLi statement.");
    }
}

function checkLoginStatus()
{
    if (isset($_SESSION['loggedin']))
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

function logout()
{
    session_destroy();
    session_start();
}
}

Answer 1

Add parenthesis:

$stmt->bind_param("ss", $user, (md5($pass . $this->salt)));

Answer 2

The problem is that the 3rd parameter is the result of a function call:

md5($pass . $this->salt)

You need to save that value to a variable before passing it to bind_param so that it can be passed by reference.

Example:

$password = md5($pass . $this->salt);  
$stmt->bind_param("ss", $user, $password);

Also, don't use md5 to hash passwords.

Answer 3

This was likely fixed in PHP 5.4 as part of Function Array Dereferencing (FAD) (revision 300266).

Alternatively as workaround try adding extra brackets, e.g.

$stmt->bind_param("ss", $user, (md5($pass . $this->salt)));

which would dereference the method/function return, see: (<5.6) Occasionally significant parentheses.

Answer 4

bind_param's params are references to variables. You can't use md5() there. You need to save it to a variable first.

$userPass = md5($pass . $this->salt);
$stmt->bind_param("ss", $user, $userPass);