note 96544 added to pdo.prepare

Use prepared statements to ensure integrity of binary data during storage and retrieval. Escaping/quoting by f.e. sqlite_escape_string() or PDO::quote() is NOT suited for binary data - only for strings of text. A simple test verifies perfect storage and retrieval with prepared statements: <?php $num_values = 10000; $db = new pdo( 'sqlite::memory:' ); $db->exec( 'CREATE TABLE data (binary BLOB(512));' ); // generate plenty of troublesome, binary data for( $i = 0; $i < $num_values; $i++ ) { for( $val = null, $c = 0; $c < 512/16; $c++ ) $val .= md5( mt_rand(), true ); @$binary[] = $val; } // insert each value by prepared statement for( $i = 0; $i < $num_values; $i++ ) $db->prepare( 'INSERT INTO data VALUES (?);' )->execute( array($binary[$i]) ); // fetch the entire row $data = $db->query( 'SELECT binary FROM data;' )->fetchAll( PDO::FETCH_COLUMN ); // compare with original array, noting any mismatch for( $i = 0; $i < $num_values; $i++ ) if( $data[$i] != $binary[$i] ) echo "[$i] mismatch\n"; $db = null; ?> ---- Server IP: 80.67.10.226 Probable Submitter: 83.227.160.33 ---- Manual Page -- http://www.php.net/manual/en/pdo.prepare.php Edit -- https://master.php.net/note/edit/96544 Del: integrated -- https://master.php.net/note/delete/96544/integrated Del: useless -- https://master.php.net/note/delete/96544/useless Del: bad code -- https://master.php.net/note/delete/96544/bad+code Del: spam -- https://master.php.net/note/delete/96544/spam Del: non-english -- https://master.php.net/note/delete/96544/non-english Del: in docs -- https://master.php.net/note/delete/96544/in+docs Del: other reasons-- https://master.php.net/note/delete/96544 Reject -- https://master.php.net/note/reject/96544 Search -- https://master.php.net/manage/user-notes.php