note 103545 added to pdostatement.bindparam

@Steve M: I just got bit by that one. PDO::PARAM_INT should *NEVER* quote an integer, since it's a number and not a string. PDO::PARAM_BOOL also suffers from this. If I say '$statement->bindParam(":someBool", "true", PDO::PARAM_BOOL")', the resulting SQL statement quotes the value 'true'. It should either leave it raw or else convert it to the non-quoted integer value 0 or 1, depending. This is great, because now I don't know how to use prepared statements with confidence, knowing that PDO's parameter-binding logic is buggy. And yet I'm not comfortable with letting people do SQL injections. So it's one of those "can't use it, can't not use it" situations with no apparent solution short of going into the C source code and patching PDO and recompiling. Also, it appears that setting the PDO::ATTR_EMULATE_PREPARES attribute to TRUE or FALSE does not make any difference in the quoting behavior. ::shrug:: ---- Server IP: 69.147.83.197 Probable Submitter: 75.97.144.171 ---- Manual Page -- http://www.php.net/manual/en/pdostatement.bindparam.php Edit -- https://master.php.net/note/edit/103545 Del: integrated -- https://master.php.net/note/delete/103545/integrated Del: useless -- https://master.php.net/note/delete/103545/useless Del: bad code -- https://master.php.net/note/delete/103545/bad+code Del: spam -- https://master.php.net/note/delete/103545/spam Del: non-english -- https://master.php.net/note/delete/103545/non-english Del: in docs -- https://master.php.net/note/delete/103545/in+docs Del: other reasons-- https://master.php.net/note/delete/103545 Reject -- https://master.php.net/note/reject/103545 Search -- https://master.php.net/manage/user-notes.php