note 103545 deleted from pdostatement.bindparam by danbrown

Note Submitter: Michael Chang ---- @Steve M: I just got bit by that one. PDO::PARAM_INT should *NEVER* quote an integer, since it's a number and not a string. PDO::PARAM_BOOL also suffers from this. If I say '$statement->bindParam(":someBool", "true", PDO::PARAM_BOOL")', the resulting SQL statement quotes the value 'true'. It should either leave it raw or else convert it to the non-quoted integer value 0 or 1, depending. This is great, because now I don't know how to use prepared statements with confidence, knowing that PDO's parameter-binding logic is buggy. And yet I'm not comfortable with letting people do SQL injections. So it's one of those "can't use it, can't not use it" situations with no apparent solution short of going into the C source code and patching PDO and recompiling. Also, it appears that setting the PDO::ATTR_EMULATE_PREPARES attribute to TRUE or FALSE does not make any difference in the quoting behavior. ::shrug::