Prepared Statements
Prepared statements separate SQL from data, preventing SQL injection. Use prepare() and execute() with placeholders.
PHP
Intermediate
5 min read
Prepared Statements
Example
<?php
// Named placeholders (recommended)
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email AND active = :active");
$stmt->execute(["email" => $email, "active" => 1]);
$user = $stmt->fetch();
// Positional placeholders
$stmt = $pdo->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->execute([$name, $email]);
// Reuse prepared statement in a loop
$stmt = $pdo->prepare("INSERT INTO logs (level, message) VALUES (?, ?)");
foreach ($logs as $log) {
$stmt->execute([$log["level"], $log["message"]]);
} Pro Tip
Named placeholders (:name) are more readable than positional (?) and immune to parameter reordering mistakes.