Skip to content

Field Manual PHP / Laravel reference

PDO prepared statements

PDO provides parameterized database access in plain PHP.

PDO prepared statement SQL injection

What it is

PDO provides parameterized database access in plain PHP.

When to use it

Use when working without Laravel.

Syntax

$stmt = $pdo->prepare("SELECT id, name FROM users WHERE id = ?");
$stmt->execute([$id]);

Example

$pdo = new PDO("sqlite:" . __DIR__ . "/database.sqlite", options: [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
$stmt = $pdo->prepare("SELECT id, name FROM users WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch();

Common mistakes

Parameters bind values, not table names; whitelist identifiers.

Related topics