title: Doctrine raw sql and prepared statements
body: <p>I've got a Doctrine_RawSql query using prepared statements. However, they seem to get ignored when the SQL query is generated. But If I leave out the token values, I get an exception about number of bound variables not matching (so it's at least trying to sub them in).</p>
  
  <p>If I include these values inline, is Doctrine doing anything behind the scenes to prevent SQL injection?</p>
  
  <p>Here's my code:</p>
  
  <pre><code>public function sortedPhotogsByLocation($location)
  {
      $q = new Doctrine_RawSql();
      $result = $q-&gt;select('{p.*}')
              -&gt;from('photographers p')
              -&gt;addComponent('p', 'Photographer')
              -&gt;where('p.city_id = ?', $location-&gt;id)
              -&gt;orderBy('CASE WHEN p.lname &lt; "?%" THEN 1 ELSE 0 END, p.lname ASC', $location-&gt;photographer_sort)
              -&gt;execute();
      return $result;
  }
  </code></pre>
  
  <p>This provides the following SQL output:</p>
  
  <pre><code>  SELECT *  
    FROM photographers p 
    WHERE p.city_id = ? 
    ORDER BY 
      CASE WHEN p.lname &lt; "?%" THEN 1 ELSE 0 END, p.lname 
    ASC
  </code></pre>
  
  <p>EDIT: The properties on <code>$location</code> are being set properly. If I hardcode the parameters:</p>
  
  <pre><code>-&gt;where('p.city_id = ?', 5)
  </code></pre>
  
  <p>I encounter the same problem with the tokens not being replaced.</p>