views:

60

answers:

2

I have an assoc array filled with the values necessary for a PDOstatement. Should I, bind each value then call execute? Or call execute passing it the array of values?

Array(
  [name] => Joe
  [value] => some content
)

Should I:

foreach($data as $key => $value){
  $statement->bindValue($key, $value);
}
execute();

OR

execute($data);

As far as I am aware, binding the data does some form of data sanitation similar to mysql_real_escape_string. I am uncertain whether I need to bind the values to achieve that affect or if I can just pass the data array to execute() and assume it has been properly escaped?

+2  A: 

As far as you do a prepare(), you can bind values in any way you want.

Read the docs; link text link text

Kemo
I realize I can bind any values, the question is should I walk through my array and bind every value individually, or is there a way to bind them all automatically.
tvanover
I added a second link for a array binding function, take a look at it.
Kemo
So I should be binding each array value individually and not trusting execute() to do it for me?
tvanover
A: 

It doesn't matter when you use a prepared statement.

Please note that your data will not be sanitized nor escaped in any way, it is entered in the database exactly as it is.

By the way, Kemo is right, but this is the more appropriate link: or use bind or use an array

jeroen
wait, I thought that was the benefits of using prepare and bind functions. Should I be using mysql_real_escape_string on data before binding it? Does PDO use mysql_connect() at some point so that mysql_real_escape_string will work?
tvanover
Don´t know, I don´t use mysql_real_escape_string as it´s not necessary anymore: A prepared statement prepares the statement so that any data you enter as a variable is really seen as a variable and not as a part of a mysql statement.
jeroen
So then preparing the statement does somehow escape the data so mySQL treats the bound value/variable as data? Otherwise I would assume that escaping the data would still be necessary.
tvanover