Bind variables in a mysql_query statement

Question

Example mysql_query:

$query=mysql_query("SELECT `col1`, `col2` FROM `table` WHERE
`col1`='$escapedvariable' ");

I know the above is not good in practice.

Better query using prepare and execute

$pSt = $dbh->prepare('SELECT col1, col2 FROM table WHERE col1=:col1);

$pSt->execute(array(':col1'=>$escapedvariable);

$status=$pSt->errorCode();

Question: Can I use mysql_query with bound variables for added security?

NOTE for future readers: The second code snippet (using prepare) is for PDO. Hence :col1 as a bound parameter. If instead you are using mysqli then use ? for bound parameters. mysqli parameters are not named - they are determined by their order in the sql. — ToolmakerSteve
– ToolmakerSteve, Commented Oct 23, 2019 at 15:31

Björn · Accepted Answer · 2011-01-29 12:23:38Z

4

No, you have to use mysqli-functions or PDO.

answered Jan 29, 2011 at 12:23

Björn

29.4k9 gold badges67 silver badges84 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Vote for put PDO to the first place ;-P

second vote for PDO => ttp://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/