What the bindValue() docs fail to explain without reading them _very_ carefully is that bindParam() is passed to PDO byref - whereas bindValue() isn't.
Thus with bindValue() you can do something like $stmt->bindValue(":something", "bind this"); whereas with bindParam() it will fail because you can't pass a string by reference, for example.
PHP - Manual: PDOStatement::bindValue
2024-11-15
PDOStatement::bindValue
(PHP 5 >= 5.1.0, PHP 7, PHP 8, PECL pdo >= 1.0.0)
PDOStatement::bindValue — 把一个值绑定到一个参数
说明
绑定一个值到用作预处理的 SQL 语句中的对应命名占位符或问号占位符。
参数
-
parameter -
参数标识符。对于使用命名占位符的预处理语句，应是类似 :name 形式的参数名。对于使用问号占位符的预处理语句，应是以1开始索引的参数位置。
-
value -
绑定到参数的值
-
data_type -
使用 PDO::PARAM_* 常量明确地指定参数的类型。
返回值
成功时返回 true， 或者在失败时返回 false。
范例
示例 #1 执行一条使用命名占位符的预处理语句
<?php
/* 通过绑定的 PHP 变量执行一条预处理语句 */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < :calories AND colour = :colour');
$sth->bindValue(':calories', $calories, PDO::PARAM_INT);
$sth->bindValue(':colour', $colour, PDO::PARAM_STR);
$sth->execute();
?>
示例 #2 执行一条使用问号占位符的预处理语句
<?php
/* 通过绑定的 PHP 变量执行一条预处理语句 */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < ? AND colour = ?');
$sth->bindValue(1, $calories, PDO::PARAM_INT);
$sth->bindValue(2, $colour, PDO::PARAM_STR);
$sth->execute();
?>
参见
- PDO::prepare() - 准备要执行的语句，并返回语句对象
- PDOStatement::execute() - 执行一条预处理语句
- PDOStatement::bindParam() - 绑定一个参数到指定的变量名
add a note
User Contributed Notes 14 notes
streaky at mybrokenlogic dot com ¶
14 years ago
D.Kellner ¶
6 years ago
When binding parameters, apparently you can't use a placeholder twice (e.g. "select * from mails where sender=:me or recipient=:me"), you'll have to give them different names otherwise your query will return empty handed (but not fail, unfortunately). Just in case you're struggling with something like this.
e-ruiz at git hub ¶
5 years ago
Be careful when trying to validate using PDO::PARAM_INT.
Take this sample into account:
<?php
/* php --version
* PHP 5.6.25 (cli) (built: Aug 24 2016 09:50:46)
* Copyright (c) 1997-2016 The PHP Group
* Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
*/
$id = '1a';
$stm = $pdo->prepare('select * from author where id = :id');
$bind = $stm->bindValue(':id', $id, PDO::PARAM_INT);
$stm->execute();
$authors = $stm->fetchAll();
var_dump($id); // string(2)
var_dump($bind); // true
var_dump((int)$id); // int(1)
var_dump(is_int($id)); // false
var_dump($authors); // the author id=1 =(
// remember
var_dump(1 == '1'); // true
var_dump(1 === '1'); // false
var_dump(1 === '1a'); // false
var_dump(1 == '1a'); // true
?>
My opinion: bindValue() should test is_int() internaly first of anything,
It is a bug? I'm not sure.
cpd-dev ¶
12 years ago
Although bindValue() escapes quotes it does not escape "%" and "_", so be careful when using LIKE. A malicious parameter full of %%% can dump your entire database if you don't escape the parameter yourself. PDO does not provide any other escape method to handle it.
Anonymous ¶
11 years ago
Note that the third parameter ($data_type) in the majority of cases will not type cast the value into anything else to be used in the query, nor will it throw any sort of error if the type does not match up with the value provided. This parameter essentially has no effect whatsoever except throwing an error if it is set and is not a float, so do not think that it is adding any extra level of security to the queries.
The two exceptions where type casting is performed:
- if you use PDO::PDO_PARAM_INT and provide a boolean, it will be converted to a long
- if you use PDO::PDO_PARAM_BOOL and provide a long, it will be converted to a boolean
<?php
$query = 'SELECT * FROM `users` WHERE username = :username AND `password` = ENCRYPT( :password, `crypt_password`)';
$sth= $dbh->prepare($query);
// First try passing a random numerical value as the third parameter
var_dump($sth->bindValue(':username','bob', 12345.67)); // bool(true)
// Next try passing a string using the boolean type
var_dump($sth->bindValue(':password','topsecret_pw', PDO::PARAM_BOOL)); // bool(true)
$sth->execute(); // Query is executed successfully
$result = $sth->fetchAll(); // Returns the result of the query
?>
contact[at]maximeelomari.com ¶
10 years ago
This function is useful for bind value on an array. You can specify the type of the value in advance with $typeArray.
<?php
/**
* @param string $req : the query on which link the values
* @param array $array : associative array containing the values to bind
* @param array $typeArray : associative array with the desired value for its corresponding key in $array
* */
function bindArrayValue($req, $array, $typeArray = false)
{
if(is_object($req) && ($req instanceof PDOStatement))
{
foreach($array as $key => $value)
{
if($typeArray)
$req->bindValue(":$key",$value,$typeArray[$key]);
else
{
if(is_int($value))
$param = PDO::PARAM_INT;
elseif(is_bool($value))
$param = PDO::PARAM_BOOL;
elseif(is_null($value))
$param = PDO::PARAM_NULL;
elseif(is_string($value))
$param = PDO::PARAM_STR;
else
$param = FALSE;
if($param)
$req->bindValue(":$key",$value,$param);
}
}
}
}
/**
* ## EXEMPLE ##
* $array = array('language' => 'php','lines' => 254, 'publish' => true);
* $typeArray = array('language' => PDO::PARAM_STR,'lines' => PDO::PARAM_INT,'publish' => PDO::PARAM_BOOL);
* $req = 'SELECT * FROM code WHERE language = :language AND lines = :lines AND publish = :publish';
* You can bind $array like that :
* bindArrayValue($array,$req,$typeArray);
* The function is more useful when you use limit clause because they need an integer.
* */
?>
Vladimir Kovpak ¶
7 years ago
<?php
/**
* Bind bit value.
*/
$sql = 'SELECT * FROM myTable WHERE level & ?';
$sth = \App::pdo()->prepare($sql);
$sth->bindValue(1, 0b0101, \PDO::PARAM_INT);
$sth->execute();
$result = $sth->fetchAll(\PDO::FETCH_ASSOC);
nicolas dot baptiste at gmail dot com ¶
12 years ago
This actually works to bind NULL on an integer field in MySQL :
$stm->bindValue(':param', null, PDO::PARAM_INT);
me at iabdullah dot info ¶
7 years ago
The reason that we cannot define the value variable for bindValue() after calling it, is because that it binds the value to the prepared statement immediately and does not wait until the execute() to happen.
The following code will issue a notice and prevent the query from taking place:
<?php
$st = $db->prepare ("SELECT * FROM posts WHERE id= :val ");
$st->bindValue(':val',$val);
$val = '2';
$st->execute();
?>
The output:
Notice: Undefined variable: val.
Whereas in the case of bindParam, the evaluation of the value to the parameter will not be performed until the call of execute(). And that's to gain the benefit of reference passing.
<?php
$st = $db->prepare ("SELECT * FROM posts WHERE id = :val ");
$st->bindParam(':val',$val);
$val = '2';
//
// some code
//
$val = '3'; // re-assigning the value variable
$st->execute();
?>
works fine.
ts//tpdada//art//pl ¶
15 years ago
For bind whole array at once
<?php
function PDOBindArray(&$poStatement, &$paArray){
foreach ($paArray as $k=>$v){
@$poStatement->bindValue(':'.$k,$v);
} // foreach
} // function
// example
$stmt = $dbh->prepare("INSERT INTO tExample (id,value) VALUES (:id,:value)");
$taValues = array(
'id' => '1',
'value' => '2'
); // array
PDOBindArray($stmt,$taValues);
$stmt->execute();
?>
goofiq dot no dot spam at antispam dot wp dot pl ¶
12 years ago
bindValue with data_type depend parameter name
<?php
$db = new PDO (...);
$db -> setAttribute (PDO::ATTR_STATEMENT_CLASS, array ('MY_PDOStatement ', array ($db)));
class MY_PDOStatement extends PDOStatement {
public function execute ($input = array ()) {
foreach ($input as $param => $value) {
if (preg_match ('/_id$/', $param))
$this -> bindValue ($param, $value, PDO::PARAM_INT);
else
$this -> bindValue ($param, $value, PDO::PARAM_STR);
}
return parent::execute ();
}
}
?>
consatangmailcom ¶
6 years ago
The parameter must names like a php variable.
e.g.
<?php
$dbh = new PDO("mysql:dbname=test;host=127.0.0.1", "user", "password");
$sth = $dbh->prepare("SELECT * FROM `table` WHERE `last-name`=:last-name");
if($sth !== false && $sth->bindValue(":last-name", "Ngo")) {
$sth->execute();
}
// output: PHP Warning: PDOStatement::execute(): SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
?>
sageptr at gmail dot com ¶
5 years ago
Be careful in edge cases!
With MySQL native prepares your integer can be wrapped around on some machines:
<?php
$x = 2147483648;
var_dump($x); // prints: int(2147483648)
$s = $db->prepare('SELECT :int AS I, :str AS S;');
$s->bindValue(':int', $x, PDO::PARAM_INT);
$s->bindValue(':str', $x, PDO::PARAM_STR);
$s->execute();
var_dump( $s->fetchAll(PDO::FETCH_ASSOC) );
/* prints: array(2) {
["I"]=>
string(11) "-2147483648"
["S"]=>
string(10) "2147483648"
} */
?>
Also, trying to bind PDO::PARAM_BOOL in MySQL with native prepares can make your query silently fail and return empty set.
Emulated prepares work more stable in this cases, because they convert everything to strings and just decide whenever to quote argument or not to quote.
官方地址：https://www.php.net/manual/en/pdostatement.bindvalue.php
IT
PHP
编程语言
Linux
开发编程
科技
Elasticsearch
HTML/CSS/XML
网络
JAVA
NoSQL
数据库
面试
C/C++
Golang
Git
算法
操作系统
正则表达式
Redis
互联网
MySql
JavaScript
运维
软件
国际
架构设计
Mac OS
TCP/IP
Excel
Vim
Windows
Socket
Oracle
VR
MongoDB
Python
运营
MemCache
商业
硬件
电子
娱乐
设计
nginx
摄影
游戏
WordPress
HTTP
团建
数码电器
广告
--
php7 安装fileinfo扩展
preg_split — 通过一个正则表达式分隔字符串
php位值,解决 PHP 中 usort 在值相同时改变原始位置的问题
[PHP] inet_pton/inet_ntop IP地址转换函数
array_multisort() 多字段排序
PHPMailer设置utf8 PHPMailer字符集CharSet
ADORecordSet对象
adodb手册
PHP 8.1
[鸟哥]PHP_INT_MIN 和 -9223372036854775808
opcache预加载
Composer的Packagist资源
mysql面试题
[鸟哥]PHP FFI详解 - 一种全新的PHP扩展方式
PHP7添加redis扩展
PHP mkdir()写出来的权限与mode值不符合
Packagist / Composer 中国全量镜像
PHP获取指定函数定义在哪个文件中及行号
adodb连接mysql多个数据库的问题
PHPstorm 里面Terminal 不能使用 esc键吗退出编辑模式吗