Question

As I know there is a way to input data into a mysql database with mysqli, where you do not have to use mysql_real_escape_string. I mean like this:

$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");  
$stmt->bind_param('sssd', "something", "something2", "something3", "123");

Now my question: Can you do the same with UPDATE instead of INSERT? What would the expression look like? Would it look like the following:

$stmt = $mysqli->prepare("UPDATE CountryLanguage SET some = ?, some2 = ?, some3 = ?, some4 = ?"); 
$stmt->bind_param('sssd', "something", "something2", "something3", "123");`

Thanks for your help.

Answer 1

It would look the same, but don’t forget the WHERE. Your example is correct.