|
PDO::preparePrepares a statement for execution and returns a statement object Description
public PDOStatementfalse PDO::prepare(string
$query , array $options = [])Prepares an SQL statement to be executed by the PDOStatement::execute method. The statement template can contain zero or more named (:name) or question mark (?) parameter markers for which real values will be substituted when the statement is executed. Both named and question mark parameter markers cannot be used within the same statement template; only one or the other parameter style. Use these parameters to bind any user-input, do not include the user-input directly in the query. You must include a unique parameter marker for each value you wish to pass in to the statement when you call PDOStatement::execute. You cannot use a named parameter marker of the same name more than once in a prepared statement, unless emulation mode is on.
Calling PDO::prepare and PDOStatement::execute for statements that will be issued multiple times with different parameter values optimizes the performance of your application by allowing the driver to negotiate client and/or server side caching of the query plan and meta information. Also, calling PDO::prepare and PDOStatement::execute helps to prevent SQL injection attacks by eliminating the need to manually quote and escape the parameters. PDO will emulate prepared statements/bound parameters for drivers that do not natively support them, and can also rewrite named or question mark style parameter markers to something more appropriate, if the driver supports one style but not the other.
As of PHP 7.4.0, question marks can be escaped by doubling them. That means that
the Parameters
Return Values
If the database server successfully prepares the statement,
PDO::prepare returns a
PDOStatement object.
If the database server cannot successfully prepare the statement,
PDO::prepare returns
Errors/Exceptions
Emits an error with level
Throws a PDOException if the attribute Examples
Example #1 SQL statement template with named parameters
Example #2 SQL statement template with question mark parameters
Example #3 SQL statement template with question mark escaped
See Also
|