Here’s the code, and it fails about 1 in 12 times. Input is a form submission including a ‘song’ parameter that should be an integer.

$DB = new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME .';charset=utf8', DB_USER , DB_PASS);
$DB->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$DB->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
...
else if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  // validate input
  $reqid = $_POST['song'];
  if (empty($reqid))
    $answer = array('success' => 0, 'message' => 'missing input song');
  else
    $cur = $DB->prepare("SELECT id, title FROM library WHERE id = ? and requestable = 1");
    $cur->execute(array($reqid));  # line 49

Not always, but a little less than 10% of the POST requests throws this error:

PHP message: PHP Fatal error:  Uncaught PDOException: SQLSTATE[HY093]: Invalid parameter number in /srv/http/api/request.php:49

I’ve already trawled Stackoverflow for “Invalid parameter number”, I’m not using the same named bindparam twice, and I didn’t mistype ‘?’ as a param name in the prepare statement.

Originally it was :reqid and execute(array('reqid' => $reqid)) but that fails with the same frequency and with the same exception; after reading over and over again “you used the same named bindparam twice,” I tried not using a named bindparam at all. I thought this might be an error about passing bad data misnamed as “parameter count” but it still fails when I test for empty().