PDO准备在where子句中具有多个条件的语句

Question

If I'm using PDO prepared statements, and I have a query like this:

SELECT cat_name, cat_id_PK, cat_amount
FROM categories
WHERE month=? AND is_recurring = '0'
ORDER BY cat_name ASC;

$results->bindValue(1, $cur_month);

Should I also be binding the value of the is_recurring clause? The '0' is hard-coded in, and I don't think it would leave me vulnerable to SQL injection, but I wanted to ask to be sure. I noticed in a tutorial I was looking at that they did bind the value even though it wasn't a variable being passed, which made me wonder if I was doing it right.

Answer 1

No, in this situation binding is not necessary. As stated by PHP.net , prepared statements serve two purposes:

1. the query only needs to be parsed once, and therefore runs faster
2. they prevent SQL injection

Since you are hardcoding that value in the query, both are not applicable. The query stays the same, so it only has to be compiled once. And there is no user input pasted into the query, so SQL injection is impossible. (as long as you do bind the other value, of course)

Conclusion: You don't have to bind the 0 , because it's not variable.

Answer 2

在这种情况下，绑定不是必需的，它不是变量。