.NET's SqlParameters in PHP

Question

What is the counterpart of Command.SqlParameters.AddWithValue() of .NET in PHP? I want to avoid SQL injection, I just wonder if PHP already has the same method aside from escaping strings thru mysql_real_escape().

Thanks in advance!

Phil · Accepted Answer · 2011-08-10 01:03:11Z

1

PDO's prepare() method and PDOStatement::bindParam() or PDOStatement::bindValue()

The difference between the two is bindParam() binds a reference to a variable. The variable value can change without having to re-bind the parameter. This is particularly useful in loops.

bindValue() simply binds a static value to a parameter.

answered Aug 10, 2011 at 1:03

Phil

166k25 gold badges265 silver badges269 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

kazinix Over a year ago

Wow! It's more than what I need, that PDO also has transactions, commit and rollback. Thanks! By the way, I don't agree with execution of query in each iteration of loop. He he.

Phil Over a year ago

@domanokz It's just handy to know. Some DBs will only allow a single set of values in an insert statement. If you have an array or collection of entries to insert, it's nice and clean to bind once to the variables and execute the inserts while looping

Collectives™ on Stack Overflow

.NET's SqlParameters in PHP

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related