Prepared Statement

Also Known As

TL;DR

Explanation

A prepared statement separates the SQL structure (sent to the database first) from the data values (bound and sent separately). The database parses the query once and treats the bound values as data, never as SQL syntax — making SQL injection structurally impossible regardless of what the user submits. Both PDO (with named :param or positional ? placeholders) and MySQLi (with bind_param()) support prepared statements. Never use string concatenation to build SQL queries.

Common Misconception

Why It Matters

Common Mistakes

• Binding only some parameters and concatenating the rest — every external value must be bound.
• Using PDO emulated prepares (the default) which can be bypassable — set PDO::ATTR_EMULATE_PREPARES to false.
• Confusing query parameters with identifiers — you cannot bind table or column names, only values.
• Reusing a statement handle but forgetting to call execute() again after changing bound values.

Code Examples

$id = $_GET['id'];
$rows = $pdo->query("SELECT * FROM users WHERE id = $id"); // SQLi

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);
$user = $stmt->fetch();

References

• ↗ https://www.php.net/manual/en/pdo.prepare.php
• ↗ https://www.php.net/manual/en/mysqli.prepare.php

Tags

Related Terms