PDO::prepare()

(PHP 5 >= 5.1.0, PHP 7, PECL pdo >= 0.1.0)

准备要执行的语句，并返回语句对象

说明

为PDOStatement::execute()方法准备待执行的 SQL 语句。 SQL 语句可以包含零个或多个参数占位标记，格式是命名（:name）或问号（?）的形式，当它执行时将用真实数据取代。在同一个 SQL 语句里，命名形式和问号形式不能同时使用；只能选择其中一种参数形式。请用参数形式绑定用户输入的数据，不要直接字符串拼接到查询里。

调用PDOStatement::execute()时，每一个值的参数占位标记，名称必须唯一。除非启用模拟（emulation）模式，同一个语句里无法使用重名的参数。

参数占位符仅能字面上展示完整的数据。不能是字面的一部分，不能是关键词，不能是标识符，不能是其他任意的范围。举例说明：不能把多个值绑到单个参数里，然后在 SQL 语句里用 IN()查询。

如果用不同参数，通过PDO::prepare()和PDOStatement::execute()多次调用同一个 SQL 语句，将提升应用的性能——驱动可以让客户端/服务器缓存查询和元信息，还能阻止 SQL 注入攻击，不需要手动给参数加引号。

如果内置驱动不支持参数，PDO 将模拟出参数的功能；如果驱动仅仅支持其中一种风格（命名参数和问号参数两种），也会自动重写到另外一种风格。

参数

必须是对目标数据库服务器有效的 SQL 语句模板。

数组包含一个或多个 key=>value 键值对，为返回的 PDOStatement 对象设置属性。常见用法是：设置PDO::ATTR_CURSOR为PDO::CURSOR_SCROLL，将得到可滚动的光标。某些驱动有驱动级的选项，在 prepare 时就设置。

返回值

如果数据库服务器完成准备了语句，PDO::prepare()返回PDOStatement对象。如果数据库服务器无法准备语句，PDO::prepare()返回FALSE或抛出PDOException(取决于错误处理器)。

模拟模式下的 prepare 语句不会和数据库服务器交互，所以PDO::prepare()不会检查语句。

范例

用命名参数形式准备 SQL 语句参数

用问号形式准备 SQL 语句参数

参见

• PDO::exec() 执行一条 SQL 语句，并返回受影响的行数
• PDO::query() 执行 SQL 语句，以 PDOStatement 对象形式返回结果集
• PDOStatement::execute() 执行一条预处理语句

To those wondering why adding quotes to around a placeholder is wrong, and why you can't use placeholders for table or column names:
There is a common misconception about how the placeholders in prepared statements work: they are not simply substituted in as (escaped) strings, and the resulting SQL executed. Instead, a DBMS asked to "prepare" a statement comes up with a complete query plan for how it would execute that query, including which tables and indexes it would use, which will be the same regardless of how you fill in the placeholders.
The plan for "SELECT name FROM my_table WHERE id = :value" will be the same whatever you substitute for ":value", but the seemingly similar "SELECT name FROM :table WHERE id = :value" cannot be planned, because the DBMS has no idea what table you're actually going to select from.
Even when using "emulated prepares", PDO cannot let you use placeholders anywhere, because it would have to work out what you meant: does "Select :foo From some_table" mean ":foo" is going to be a column reference, or a literal string?
When your query is using a dynamic column reference, you should be explicitly white-listing the columns you know to exist on the table, e.g. using a switch statement with an exception thrown in the default: clause.

You can also pass an array of values to PDOStatement::execute(). This is also secured against SQL injection. You don't necessarily have to use bindParam() or bindValue().

Hi All,
First time posting to php.net, a little nervous.
After a bunch of searching I've learned 2 things about prepared statements:
1.) It fails if you enclose in a single quote (')
This fails: "SELECT * FROM users WHERE email=':email'"
This works: "SELECT * FROM users WHERE email=:email"
2.) You cannot search with a prepared statement
This fails: "SELECT * FROM users WHERE :search=:email"
This succeeds: "SELECT * FROM users WHERE $search=:email"
In my case I allow the user to enter their username or email, determine which they've entered and set $search to "username" or "email". As this value is not entered by the user there is no potential for SQL injection and thus safe to use as I have done.
Hope that saves someone else from a lot of searching.

if you run queries in a loop, don't include $pdo->prepare() inside the loop, it will save you some resources (and time).
prepare statement inside loop:
for($i=0; $iprepare("SELECT `id` FROM `admins` WHERE `groupID` = :groupID AND `id`  :id");
  $rs->execute([':groupID' => $group, ':id' => $id]);
}
// took 0.066626071929932 microseconds
prepare statement outside loop:
$rs = $pdo->prepare("SELECT `id` FROM `admins` WHERE `groupID` = :groupID AND `id`  :id");
for($i=0; $iexecute([':groupID' => $group, ':id' => $id]);
}
// took 0.064448118209839 microseconds
for 1,000 (simple) queries it took 0.002 microseconds less.
not much, but it worth mention.

Note on the SQL injection properties of prepared statements.
Prepared statements only project you from SQL injection IF you use the bindParam or bindValue option.
For example if you have a table called users with two fields, username and email and someone updates their username you might run
UPDATE `users` SET `user`='$var'
where $var would be the user submitted text. 
Now if you did 

鹏仔微信 15129739599 鹏仔QQ344225443 鹏仔前端 pjxi.com 共享博客 sharedbk.com