note 104503 added to pdostatement.bindvalue

Note that the third parameter ($data_type) in the majority of cases will not type cast the value into anything else to be used in the query, nor will it throw any sort of error if the type does not match up with the value provided. This parameter essentially has no effect whatsoever except throwing an error if it is set and is not a float, so do not think that it is adding any extra level of security to the queries. The two exceptions where type casting is performed: - if you use PDO::PDO_PARAM_INT and provide a boolean, it will be converted to a long - if you use PDO::PDO_PARAM_BOOL and provide a long, it will be converted to a boolean <?php $query = 'SELECT * FROM users WHERE username = :username AND password = ENCRYPT( :password, crypt_password)'; $sth= $dbh->prepare($query); // First try passing a random numerical value as the third parameter var_dump($sth->bindValue(':username','bob', 12345.67)); // bool(true) // Next try passing a string using the boolean type var_dump($sth->bindValue(':password','topsecret_pw', PDO::PARAM_BOOL)); // bool(true) $sth->execute(); // Query is executed successfully $result = $sth->fetchAll(); // Returns the result of the query ?> ---- Server IP: 208.69.120.55 Probable Submitter: 190.241.39.11 ---- Manual Page -- http://www.php.net/manual/en/pdostatement.bindvalue.php Edit -- https://master.php.net/note/edit/104503 Del: integrated -- https://master.php.net/note/delete/104503/integrated Del: useless -- https://master.php.net/note/delete/104503/useless Del: bad code -- https://master.php.net/note/delete/104503/bad+code Del: spam -- https://master.php.net/note/delete/104503/spam Del: non-english -- https://master.php.net/note/delete/104503/non-english Del: in docs -- https://master.php.net/note/delete/104503/in+docs Del: other reasons-- https://master.php.net/note/delete/104503 Reject -- https://master.php.net/note/reject/104503 Search -- https://master.php.net/manage/user-notes.php