ADOdb

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
<- v5:userguide:learn_bind:bind_vars|Introduction To Binding ^ v5:userguide:userguide_index|List Of Tutorials ^ v5:userguide:learn_bind:bulkbinding|Bulk Binding ->
~~NOTOC~~

===== Bind Placeholders Across Databases =====
Bind placeholders vary from one database to another, so ADOdb provides a method [[v5:reference:connection:param|param()]] that returns a database specific placeholder. Using the above example, we can write it as a portable statement:

<code php>
$bindVars = array('A','B','C');

$col1Ph = $db->param('col1');
$col2Ph = $db->param('col2');
$col3Ph = $db->param('col3');

$sql = "SELECT * FROM some_table 
                WHERE col1=$col1Ph 
                  AND col2=$col2Ph 
                  AND col3=$col3Ph";
$result = $db->execute($sql, $bindVars);
</code>

In the above example, you can see that it is necessary to obtain a unique placeholder for each bind variable. This is because in some databases, the placeholder is uniquely associated with the column. So the executed statement in the above example would appear as follows:
==== MySQL ====
  SELECT * FROM some_table WHERE col1=? AND col2=? AND col3=?
==== Oracle ====
  SELECT * FROM some_table WHERE col1=:col1 AND col2=:col2 AND col3=:col3
==== PostgreSQL ====
  SELECT * FROM some_table WHERE col1=$1 AND col2=$2 AND col3=$3
  
===== Databases Without Bind Support =====
You can still use the bind form of execute in ADOdb if the database does not support binding. In this case ADOdb simply rewrites the query statement for you back into the non-bind form.

===== Hardening SQL Statements Against Injection Attacks =====
In addition to portability, described above, you can use the method [[v5:reference:connection:addq|addQ()]] to ensure that special characters are escaped before use inside string variables.

The following code snippet is compatible across all databases supported by ADOdb

<code php>

$col1Ph = $db->param('col1');
$col2Ph = $db->param('col2');
$col3Ph = $db->param('col3');


$bindVars = array('col1'=>$db->addQ($someVariable),
                  'col2'=>$db->addQ($someOtherVariable),
                  'col3'=>$db->addQ($yetAnotherVariable));


$sql = "SELECT * FROM some_table 
                WHERE col1=$col1Ph 
                  AND col2=$col2Ph 
                  AND col3=$col3Ph";
$result = $db->execute($sql, $bindVars);
</code>
Note that the order of the bind variables in $bindVars must match the order of insertion into the SQL statement. Some databases use $bindVars as an associative array, but some discard the indexes and use $bindVars as a numeric array.

**You should always perform sanity checks against data transmitted in from public facing websites.**