PDO Introduction — Replacing mysql_* with Prepared Statements

Also Known As

TL;DR

Explanation

Before PDO, PHP developers used database-specific extensions: mysql_* for MySQL, pg_* for PostgreSQL. None supported named prepared statements. PDO introduced a consistent interface: PDO::prepare() creates a parameterised query, execute() runs it with bound values — the driver handles escaping internally. PDO also introduced named parameters (:name) alongside positional (?) parameters. The extension became bundled with PHP 5.1 and is the standard database interface for all modern PHP.

Common Misconception

Why It Matters

Common Mistakes

• Using PDO::query() with interpolated variables instead of prepare/execute
• Not checking the return value of execute() for false
• Using ATTR_EMULATE_PREPARES without understanding it can fall back to string escaping

Code Examples

// mysql_ extension approach:
$result = mysql_query("SELECT * FROM users WHERE id=$id");
$row = mysql_fetch_assoc($result); // SQL injection risk + removed in PHP 7

// PDO with prepared statements:
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->execute([':id' => $id]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);

// PDO works across MySQL, PostgreSQL, SQLite, MSSQL

References

• ↗ https://www.php.net/manual/en/book.pdo.php
• ↗ https://phpdelusions.net/pdo

Tags

Related Terms