Refactor customer profile query to use prepared

statement

Author: HashJProgramming

profile-customer.php

@@ -15,7 +15,14 @@
 $stmt->execute();
 $results = $stmt->fetchAll();
 
-$customer_fullname = $results[0]['fullname'];
+$sql = 'SELECT fullname 
+        FROM customers 
+        WHERE id = :id';
+$stmt = $db->prepare($sql);
+$stmt->bindParam(':id', $customer_id);
+$stmt->execute();
+$info = $stmt->fetch();
+$customer_fullname = $info['fullname'];
 
 ?>