Prepared Statements (PREPARED STATEMENTS)

Prepared statements are the standard for secure programming. In PDO, instead of directly inserting values into an SQL string, we use named parameters (e.g., :name). This separates SQL logic from data, which prevents SQL injection attacks.

EXAMPLE

<?php
$server = "localhost";
$username = "root";
$password = "";
$database = "pdo_database";

try {
    $dsn = "mysql:host=$server;dbname=$database;charset=utf8mb4";
    $connection = new PDO($dsn, $username, $password);
    $connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // STEP 1: Preparing the SQL statement (Blueprint)
    // Instead of question marks (?), we use named parameters (e.g., :name, :last_name). 
    // This makes the code incomparably more readable. The prepare() method sends this blueprint 
    // to the server, where the query structure is verified and securely locked.
    $statement = $connection->prepare("INSERT INTO users (first_name, last_name, email) 
                                 VALUES (:name, :last_name, :email)");

    // STEP 2: Binding parameters (Binding)
    // We use the bindParam() function to bind named parameters to PHP variables.
    // Note: Here we only provide references to variables; actual values can be set later!
    $statement->bindParam(':name', $name);
    $statement->bindParam(':last_name', $last_name);
    $statement->bindParam(':email', $email);

    // STEP 3: Setting values and final execution (Execution)
    // We assign actual data to the variables and call the execute() method.
    // Since the data is strictly separated from the SQL structure, SQL injection is COMPLETELY DISABLED HERE!
    $name = "Nina";
    $last_name = "Hill";
    $email = "nina@example.com";
    $statement->execute();

    echo "New user was successfully and securely inserted using prepared statements!";
} catch (PDOException $e) {
    echo "Error: " . $e->getMessage();
}

// Closing the connection
$connection = null;
?>

RESULT

The result will be displayed here...

The process follows three steps: first, we prepare the statement (prepare), then we bind variables to it (bindParam), and finally, we execute the command (execute). Below, we will securely add a new member to the users table.

Named parameters (e.g., :email) make the code much more readable.
The bindParam() method binds an SQL parameter directly to a PHP variable.
The same prepared statement can be executed multiple times with different data, increasing efficiency.