PDO::ATTR_EMULATE_PREPARES

Also Known As

TL;DR

Explanation

When EMULATE_PREPARES is true (the default in some drivers), PDO performs string interpolation in PHP before sending the final SQL — defeating the security benefit of prepared statements in certain edge cases involving non-standard character encodings. Setting it to false forces the database to handle parameterisation natively. Native prepared statements also provide marginal performance benefits when the same statement is executed multiple times.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Leaving EMULATE_PREPARES at its default (true for MySQL driver) and trusting it is safe.
• Setting EMULATE_PREPARES false without also setting charset=utf8mb4 in the DSN.
• Assuming EMULATE_PREPARES=false breaks anything — it rarely does for standard CRUD operations.

Avoid When

• Do not leave EMULATE_PREPARES at its default (true) — it performs client-side escaping instead of structural parameterisation.

When To Use

• Always set EMULATE_PREPARES to false alongside charset=utf8mb4 in the DSN for maximum security.

Code Examples

// Emulated prepares + wrong charset = potential injection via multi-byte encoding
$pdo = new PDO('mysql:host=localhost;dbname=app', $user, $pass);
// PDO::ATTR_EMULATE_PREPARES defaults to true — PHP does the escaping, not MySQL

$pdo = new PDO(
    'mysql:host=localhost;dbname=app;charset=utf8mb4', // charset in DSN
    $_ENV['DB_USER'],
    $_ENV['DB_PASS'],
    [
        PDO::ATTR_ERRMODE          => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_EMULATE_PREPARES => false, // native prepared statements
    ]
);

References

• ↗ https://www.php.net/manual/en/pdo.setattribute.php

Tags

Related Terms