Скачать или смотреть Data Binding Using PDO - Become a PHP Master - 35

Parameter binding is essential for protecting your web application from SQL-injection. Pretty much all data which is going to be used in SQL statement needs binding. Binding simply saying is just a way to tell engine that a particular piece of data is a string, number, character and so on. By doing this special characters like quotes and double quotes, semi-colons, etc. won’t be interpreted as commands by the database.


This simple function returns database record by table name, primary field name and its value. bindParam is used after prepare and before execute (this is important). Question marks also might be used instead of names.

The answer is in the documentation for bindParam:

Unlike PDOStatement::bindValue(), the variable is bound as a reference and will only be evaluated at the time that PDOStatement::execute() is called.

And execute

call PDOStatement::bindParam() to bind PHP variables to the parameter markers: bound variables pass their value as input and receive the output value, if any, of their associated parameter markers.

#PHPTutorial #PHPForBeginners #AtifNaseem