PHP Academy · Lesson

Prepared Statements and Binding

Use prepare, bindParam, and execute to prevent SQL injection.

Why Prepared Statements?

Prepared statements separate SQL structure from data. User input is always treated as a value — never as SQL code — making SQL injection impossible.

Basic flow: prepare with placeholders, then execute with values.

<?php
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$_POST["email"]]);
$user = $stmt->fetch();