0Pricing
PHP Academy · Lesson

Prepared Statements and Binding

Use prepare, bindParam, and execute to prevent SQL injection.

Prepared Statements and Binding is a free PHP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Prepared Statements?

Prepared statements separate SQL structure from data. User input is always treated as a value — never as SQL code — making SQL injection impossible.

prepare() + execute()

Basic flow: prepare with placeholders, then execute with values.

<?php
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$_POST["email"]]);
$user = $stmt->fetch();

Named Placeholders

Use named placeholders (:name) for clarity, especially when the same value appears multiple times.

<?php
$stmt = $pdo->prepare(
    "INSERT INTO users (name, email) VALUES (:name, :email)"
);
$stmt->execute([':name' => "Alice", ':email' => "alice@example.com"]);

bindParam vs bindValue

bindParam binds a variable by reference — value read at execute time. bindValue binds a value immediately.

<?php
$name = "Bob";
$stmt = $pdo->prepare("INSERT INTO users (name) VALUES (:name)");
$stmt->bindParam(":name", $name);
$name = "Carol";
$stmt->execute(); // inserts "Carol"

bindValue Example

Use bindValue when you want to lock in the value at bind time.

<?php
$stmt = $pdo->prepare("SELECT * FROM products WHERE price < :max");
$stmt->bindValue(":max", 50.00, PDO::PARAM_INT);
$stmt->execute();

Type Constants

The optional third parameter specifies data type: PDO::PARAM_INT, PDO::PARAM_STR, PDO::PARAM_BOOL, PDO::PARAM_NULL.

Re-executing Statements

A prepared statement can be executed multiple times — the query is compiled once on the server.

<?php
$stmt = $pdo->prepare("INSERT INTO logs (msg) VALUES (:msg)");
foreach ($messages as $msg) {
    $stmt->execute([':msg' => $msg]);
}

rowCount()

After INSERT/UPDATE/DELETE, rowCount() returns how many rows were affected.

<?php
$stmt = $pdo->prepare("DELETE FROM users WHERE active = 0");
$stmt->execute();
echo $stmt->rowCount()." users deleted";

lastInsertId()

After an INSERT, get the auto-increment primary key with $pdo->lastInsertId().

<?php
$stmt = $pdo->prepare("INSERT INTO articles (title) VALUES (:t)");
$stmt->execute([':t' => "My Post"]);
$newId = $pdo->lastInsertId();

Never Concatenate User Input

Never do: "SELECT * FROM users WHERE name = '".$name."'". Always use placeholders — even if you "sanitised" the input.

PDOStatement Object

prepare() returns a PDOStatement with: execute(), fetch(), fetchAll(), bindParam(), bindValue(), rowCount().

Summary

Always use prepared statements for queries with external data. Prefer named placeholders. Use bindValue for immediate values and bindParam for loop bindings.

Quick Check

When does bindParam read its value?

Frequently asked questions

Is the “Prepared Statements and Binding” lesson free?

Yes — the full text of “Prepared Statements and Binding” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “Prepared Statements and Binding”?

Use prepare, bindParam, and execute to prevent SQL injection. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Prepared Statements and Binding” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Connecting to MySQL with PDO
  2. Prepared Statements and Binding
  3. Fetching Results with PDO
  4. Transactions with PDO
← Back to PHP Academy