note 107811 added to pdo.prepare

With PDO_MYSQL you need to remember about the PDO::ATTR_EMULATE_PREPARES option. The default value is TRUE, like $dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES,true); This means that no prepared statement is created with $dbh->prepare() call. With exec() call PDO replaces the placeholders with values itself and sends MySQL a generic query string. The first consequence is that the call $dbh->prepare('garbage'); reports no error. You will get an SQL error during the $dbh->exec() call. The second one is the SQL injection risk in special cases, like using a placeholder for the table name. The reason for emulation is a poor performance of MySQL with prepared statements. Emulation works significantly faster. ---- Server IP: 69.147.83.197 Probable Submitter: 94.179.137.60 ---- Manual Page -- http://www.php.net/manual/en/pdo.prepare.php Edit -- https://master.php.net/note/edit/107811 Del: integrated -- https://master.php.net/note/delete/107811/integrated Del: useless -- https://master.php.net/note/delete/107811/useless Del: bad code -- https://master.php.net/note/delete/107811/bad+code Del: spam -- https://master.php.net/note/delete/107811/spam Del: non-english -- https://master.php.net/note/delete/107811/non-english Del: in docs -- https://master.php.net/note/delete/107811/in+docs Del: other reasons-- https://master.php.net/note/delete/107811 Reject -- https://master.php.net/note/reject/107811 Search -- https://master.php.net/manage/user-notes.php