How can I Use Prepared Statements in CodeIgniter

by

CodeIgniter does not support Prepared Statements. If you look at the sourcecode for CI’s Database class, you will see that they resolve bindings simply by replacing the question marks with the data from the passed array:

They only support Query Binding with unnamed placeholders. See http://ellislab.com/codeigniter/user-guide/database/queries.html

Query Bindings

Bindings enable you to simplify your query syntax by letting the system put the queries together for you. Consider the following example:

$sql = "SELECT * FROM some_table WHERE id = ? AND status = ? AND author = ?";
$this->db->query($sql, array(3, 'live', 'Rick'));

The question marks in the query are automatically replaced with the values in the array in the second parameter of the query function.

and http://ellislab.com/forums/viewthread/105112/#528915

Even though CI doesn’t support prepared statements, it does support Query Bindings. With prepared statements you have to call some type of prepare() function and then some type of execute() function. With query bindings, you only have to call one function and it basically does the same thing. Because of this, I like query bindings better than prepared statements.

On a sidenote, changing ? to :foo is merely changing from unnamed to named bindings (which CI apparently does not support either). Just because you use either or doesn’t mean you are preparing the statements.

More Related Contents:

  1. how to select only one value sql
  2. CodeIgniter – foreach loop
  3. PHP – Change value y,n in database [closed]
  4. How to insert multiple rows from array using CodeIgniter framework?
  5. mysqli_stmt::bind_result(): Number of bind variables doesn’t match number of fields in prepared statement
  6. How to use mysqli prepared statements?
  7. MySQLi prepared statements error reporting [duplicate]
  8. MySQL Prepared statements with a variable size variable list
  9. LIMIT keyword on MySQL with prepared statement [duplicate]
  10. mysqli: can it prepare multiple queries in one statement?
  11. CodeIgniter: Unable to connect to your database server using the provided settings Error Message
  12. Is mysql_real_escape_string() broken?
  13. Why is using a mysql prepared statement more secure than using the common escape functions?
  14. mysqli_stmt::bind_param(): Number of elements in type definition string doesn’t match number of bind variables
  15. pdo prepared statements with wildcards
  16. Find total number of results in mySQL query with offset+limit
  17. Can I use a PDO prepared statement to bind an identifier (a table or field name) or a syntax keyword?
  18. Insert multiple rows with PDO prepared statements
  19. Replacing mysql_* functions with PDO and prepared statements
  20. PDOstatement (MySQL): inserting value 0 into a bit(1) field results in 1 written in table
  21. Calling stored procedure with Out parameter using PDO
  22. When *not* to use prepared statements?
  23. What are the differences between backtick and single quote? Can I use IF statement in a query as above?
  24. How to create Codeigniter language files from database?
  25. Trying to get property of non-object – CodeIgniter
  26. WordPress prepared statement with IN() condition
  27. Codeigniter Transactions
  28. Inserting NOW() into Database with CodeIgniter’s Active Record
  29. How to select rows where column value IS NOT NULL using CodeIgniter’s ActiveRecord?
  30. Using Prepared Statement, how I return the id of the inserted row?

Leave a Comment