What does bind_param() do?

php mysqli prepared-statement bindparam
cool_cs picture cool_cs · Jun 4, 2012 · Viewed 10.2k times · Source 
$resultSpendStmt = $connection->prepare(...);
$array->bind_param("sdidi", $A, $B, $C, $D, $E);
$array->execute();
$array->store_result();
$array->bind_result($F, $G, $H, $I, $J, $K);

I am still a little unsure what bind_param does. Can someone give me an example as to what is means?

Answer

Litty picture Litty · Jun 4, 2012

When you prepare an SQL statement, you can insert a placeholder (?) where a column value would go, then use bind_param() to safely substitute that placeholder for the real column's value. This prevents any possibility of an SQL injection.

You can read more about bind_param() here.

Related questions

How to prepare statement for update query?

I have a mysqli query with the following code: $db_usag->query("UPDATE Applicant SET phone_number ='$phone_number', street_name='$street_name', city='$city', county='$county', zip_code='$zip_code', day_date='$…

Read More
What exactly does first parameter in bind_param() do?

I am trying to understand prepared statements using PHP and mysqli. I tried to read on some tutorials, manual and this one: Bind_Param in PHP, but I have not yet found any satisfying answer. Someone wrote in answer as: …

Read More
bind_param problem with binding boolean values

I have a problem binding booleans using mysqli_stmt::bind_param in PHP5. The SQL query is the following: insert into `nvp_notes` (subject,messageid,receivedate,read) values (?,?,?,?) Where 'read' is a tinyint, either 0 or 1, as I've had issues with …

Read More