Difference between PDO->query() and PDO->exec()

by

Regardless of whatever theoretical difference, neither PDO::query() nor PDO::exec() should be used anyway. These functions don’t let you bind parameters to the prepared statement and should never be used.

Use prepare()/execute() instead, especially for UPDATE,INSERT,DELETE statements.

Please note that although prepared statements are widely advertised as a security measure, it is only to attract people’s attention. But their real purpose is proper query formatting. This gives you security too – as a properly formatted query cannot be injected as well – just as a side effect. But again – formatting is a primary goal, just because even innocent data may cause a query error if not formatted properly.

More Related Contents:

  1. Can I mix MySQL APIs in PHP?
  2. Can PHP PDO Statements accept the table or column name as parameter?
  3. Can I bind an array to an IN() condition in a PDO query?
  4. How to apply bindValue method in LIMIT clause?
  5. PDOException “could not find driver”
  6. Row count with PDO
  7. PDO get the last ID inserted
  8. How do I use password hashing with PDO to make my code more secure? [closed]
  9. How to view query error in PDO PHP
  10. PDO::__construct(): Server sent charset (255) unknown to the client. Please, report to the developers
  11. Insert/update helper function using PDO
  12. PHP PDO – Bind table name? [duplicate]
  13. Is the leading colon for parameter names passed to PDOStatement::bindParam() optional?
  14. How to debug PDO database queries?
  15. PDO’s query vs execute
  16. Resetting array pointer in PDO results
  17. PDO multiple queries
  18. Parametrized PDO query and `LIMIT` clause – not working [duplicate]
  19. Using htmlspecialchars function with PDO prepare and execute
  20. PDO::PARAM for type decimal?
  21. Update query with PDO and MySQL
  22. Undefined class constant ‘MYSQL_ATTR_INIT_COMMAND’ with pdo
  23. Is “SET CHARACTER SET utf8” necessary?
  24. Retrieve (or simulate) full query from PDO prepared statement
  25. PDO returning incorrect, but duplicate, data. Key’s not in database.
  26. Set PDO to throw exceptions by default [duplicate]
  27. PDO: MySQL server has gone away
  28. Checking for an empty result (PHP, PDO, and MySQL) [duplicate]
  29. PDOStatement to JSON [closed]
  30. PHP/SQL Insert Error when using Named Placeholders

Leave a Comment