Confusion between bindValue() and bindParam()?

Question

I am confuse between these two functions Bindvalue() and BindParam()

I read on php.net it does not escape % and _, so be careful when using LIKE. So i think BindValue() is not used when we are using LIKE query.
when we using LIKE query BindParam() is used. Because as i know BindParam can escape these % and _.
BindValue() doesn't gives protection against sql injection. I am not sure about this, is it true?

friends tell what i mention in these 3 points is right or wrong. i am beginner in PDO so please explain it clearly ..

http://stackoverflow.com/questions/1179874/pdo-bindparam-versus-bindvalue — Peter, Jan 19 '13 at 10:35
Possible duplicate of [What is the difference between bindParam and bindValue?](http://stackoverflow.com/questions/1179874/what-is-the-difference-between-bindparam-and-bindvalue) — tfont, Feb 02 '17 at 11:03

score 52 · Accepted Answer · answered Jan 19 '13 at 10:37

52

There should be no difference in how values are escaped or not escaped. bindParam differs from bindValue in that it references the variable, binding the value only when you execute the statement. bindValue takes the value immediately. To illustrate:

$stmt = $db->prepare('SELECT * FROM `table` WHERE foo = :foo');

$foo = 'foo';
$stmt->bindValue(':foo', $foo);
$foo = 'bar';

$stmt->execute();

The above executes like SELECT * FROM table WHERE foo = 'foo';

$stmt = $db->prepare('SELECT * FROM `table` WHERE foo = :foo');

$foo = 'foo';
$stmt->bindParam(':foo', $foo);
$foo = 'bar';

$stmt->execute()

The above executes like SELECT * FROM table WHERE foo = 'bar'.

It's true that neither cares about _ or % as special characters, because generally speaking they aren't special characters as far as the syntax is concerned, and the database driver is not able to analyze the context to figure out whether you mean % to be a wildcard or the actual character "%" in the context of a LIKE query.

Both protect against SQL injection.

answered Jan 19 '13 at 10:37

deceze

510,633
85
743
889

i want to know that bindValue() and bindParam() both gives protection against sql injection. i know it am asking stupid question but i am not sure about this that's why i am asking – Arun Pratap Singh Jan 19 '13 at 10:44
2

Yes, they do. That's what I'm saying. You should read [The Great Escapism](http://kunststube.net/escapism) for details on what SQL injection is and why prepared statements avoid it. – deceze Jan 19 '13 at 10:46
@deceze `+1` for the good explanation. But, in what cases or at what point does it become important to use one instead of the other? I just can see the reason why one should be suited to certain conditions, than the other. – samayo Oct 17 '13 at 11:26
1

@Simon By binding a variable by reference, you can bind it once, then loop through data, assign values to the variable and execute the query over and over without needing to repeatedly bind. May be slightly more efficient, but it mostly doesn't make any difference for performance. It may make code slightly cleaner though. – deceze Oct 17 '13 at 12:26

score 5 · Answer 2 · edited Oct 17 '13 at 11:23

Well, you took it all wrong.

Bindvalue() and BindParam() are equal in either way except for the argument type.

Bindvalue() binds just a value, it's like a a hard copy.
BindParam() binds a variable, and when a variable got changed, the binded value will be changed as well.

Both of them do not escape % and _, which doesn't matter too much. Such escaping affects only reliability of the returned results, not whatever "injections".

Confusion between bindValue() and bindParam()?

2 Answers2

Linked

Related