Fetching result isn't working after prepared statement

jskidd3

I’m struggling to write this myself so I will say what I know I need to do and what I have already.

Based on two $_GET[] variables I need to query a database. The values provide me with the table name and the name of the location. From this location field name, I need to extrapolate the whole row.

So, I query the database with this data, however when I try and fetch and print it nothing happens. I need the whole row’s data (in an array?).

I understand my code is ugly. And probably vulnerable to MySQL injection, but I would rather get my PHP right in terms of getting the row into an array before I worry about that.

Rough code I have so far:

$company = strtolower($_GET['company'] . '_a_in_m2f');
$company = mysqli_real_escape_string($mysqli, $company);

$stmt = $mysqli->prepare("SELECT * FROM " . $company ." WHERE `name` = '?'");
$stmt->bind_param('s', $stop);

$stop = $_GET['stop'];

$stmt->execute();

$stmt->bind_result($therow);

while ($stmt->fetch()) {
    printf("%s %s n", $therow);
}

Thanks