Question

I’m making a small web application that will be receiving data input by users regularly. When researching how to make sure the data input is cleansed first, and for that it would seem prepared statements are the way to go.

I’ve found this SO question however, and as my application (at least as far as I know) won’t be doing more than one query per page request, it would seem all I really need is the binding of values to parameters in the query.

I’ve been looking through the PHP manual on PDO and mysqli, but I can’t find any examples where values are bound to a normal query. All the examples I’ve found have a $stmt->prepare somewhere prior to the binding.

Is whether or not the statement is "prepared" something that’s determined by the support of the database, and the prepare statement will always be in the code? Or is there a way to bind parameters directly into a $dbh->query(...)?

To explain why I’m looking to see if its possible to not use prepare, is due to this statement from the SO question I linked earlier in the post:

When not to use prepared statements? When you’re only going to be running the statement once before the db connection goes away.

When not to use bound query parameters (which is really what most people use prepared statements to get)?

and this

Personally I wouldn’t bother. The pseudo-prepared statements are likely to be useful for the safe variable quoting they presumably provide.

Answer 1

How do you bind parameters to a query that isn’t prepared?

You don’t. An SQL string with parameters (i.e. question marks in specific places) needs to be parsed (i.e. prepared) first before those question marks can be treated as insertion points for parameter values.

Therefore you always need to call prepare() before you can call bind().

---

A parameterized statement is a string that contains SQL and placeholder markers (for example question marks, but different databases use different placeholders):

$sql = "SELECT user_id FROM user WHERE user_name = ?"

Now assume there’s a value you want to insert at this location:

$_POST["username"]

Preparing a statement, broadly speaking, gives the question marks their special meaning “a value can be inserted here”. In other words, it creates parameters from the placeholders.

$stmt->prepare($sql)

Binding a value to a parameter sets the parameter to a specific value.

$stmt->bind_param("s", $_POST["username"])

Now the query can be executed without the SQL string and the user-supplied value ever actually coming into contact with each other. This is the important bit: SQL and parameter values are sent to the server separately. They never touch each other.

$stmt->execute();

The advantages are:

• You can bind a new value to the parameter and execute the query again without having to repeat all of it (useful in a loop).
• SQL injection is impossible, no matter what value $_POST["username"] contains.