Prepared statements

Prepared statements separate SQL structure from user data. The database compiles the query once; parameters bind safely without string concatenation.

Named placeholders

$stmt = $pdo->prepare(
    'SELECT * FROM users WHERE email = :email LIMIT 1'
);
$stmt->execute(['email' => $email]);
$user = $stmt->fetch();

Positional placeholders

$stmt = $pdo->prepare('INSERT INTO logs (message) VALUES (?)');
$stmt->execute([$message]);

Never do this

// SQL injection risk
$sql = "SELECT * FROM users WHERE id = {$_GET['id']}";

Important interview questions and answers

1. Q: Do prepared statements always stop SQL injection?
   A: Yes for data bound as parameters—do not inject untrusted input into identifiers (table/column names) without whitelisting.
2. Q: Prepared vs escaped strings?
   A: Binding is cleaner and less error-prone than manual escaping with quote().

Self-check

1. Why is concatenating $_GET['id'] into SQL dangerous?
2. What does execute accept for named placeholders?

Tip: Bind user data as parameters—whitelisting is still required if user input picks table or column names.