Take the 2-minute tour ×

Is there an API in MySQLi, PDO or in PHP that use parameterized query but not preparing it for recall later? I found it in ADO.NET when we dont call .Prepare() method of SQLParameter, but I didn't find this in PHP.

share|improve this question
what do you want or require functionality wise. ? if you dont want to prepare a statement just use mysqli->query –  Mian Khurram Ijaz Apr 30 '11 at 10:14
I don't understand your requirements either, why don't you just prepare the statement and execute it? –  markus Apr 30 '11 at 10:35
@molvi. prepared statement is utility for executing query multiple times. think that i want to execute a query for single time. so i don't want to having unnecessary overhead on Database for preparing it. such as caching query plan in memory –  ahoo Apr 30 '11 at 10:35
I have never heard that guideline before. Parameterized queries are a security measure, if I must prepare a statement in order to use parameterized queries I don't care about a slight performance impact which most probably is not substantial. That said I don't know if you can use parameterized queries without preparing a statement, in PDO, I have never seen such a thing done. –  markus Apr 30 '11 at 10:55
@ahoo This is definitely not possible, the underlying MySQL C-API that powers all MySQL access mechanisms does not support it. There is no way this can be implemented in PHP because of a limitation of MySQL. –  DaveRandom Jan 20 '13 at 15:35
show 1 more comment

1 Answer

Prepared statements are sent to the database server with the values separated from the query. If you wanted to get the user with ID 1337, using PDO you would do this;

$sql = 'SELECT u.id, u.username FROM users u WHERE u.id = :theUserIdToGet LIMIT 1';
$stmt->bindValue(':theUserIdToGet', 1337);
$result = $stmt->fetch();

In a traditional query this would just be;

$sql = 'SELECT u.id, u.username FROM users u WHERE u.id = ' . 1337 . ' LIMIT 1';
$stmt = $db->query($sql);
$result = $stmt->fetch();

The first example clearly requires more code, however it has the following benifits;

  • Security - The values (just one in this case; 1337) are sent to the database server separately. The database server safely checks these values for bad characters and inserts them into the query before execution. Note that some query API's will emulate this, but it still offers a great deal of safety.
  • Readability - When adding more than a couple of parameters to a query, it gets very messy if concatenating strings ("WHERE id = " . $var1 . " AND " . $var2 . " = 1", etc).
  • Performance (occasionally) - It is true that prepared statements are vastly quicker when executed many times, but in practice this is very infrequent. The performance overhead of preparing a query over query() is negligible.

Prepared statements should always be used when inserting variables into a query because of their legibility and security.

PDO is generally considered to be very good, I personally use it all the time. It's learning curve is gentle and many tutorials are available on the internet. It's documentation is here

share|improve this answer
please read again my question –  ahoo Apr 30 '11 at 11:47
add comment

Your Answer


