views:

15

answers:

1

Curious as to whether or not you can prepare a statement, bind it, and then preview the generated SQL as followed (the oci_preview_sql function is a place holder):

// Glorious declaration of a non-specific query
$statment = oci_parse($handle, "SELECT x FROM y WHERE variable = :value");

// Bind up some variables
oci_bind_by_name($statement, ':value', $value);
...

// Location of interest
oci_preview_sql($statement); // ? is there some method like this?    

// Execute it
oci_execute($statement, OCI_DEFAULT);
A: 

oci supports actual prepared statements, so the query you are wondering about doesn't exist. At all levels in the database / script communication the statement with placeholders, and the parameters you send, are separate entities, which is why prepared statement are such great tools in preventing SQL injection.

Wrikken