title: Issues binding variable types using executeQuery in Doctrine DBAL
body: <p>I'm looking to use the Doctrine DBAL function executeQuery as follows:</p>
  
  <pre><code>$conn = DBAL\DriverManager::getConnection($connectionParams, $config);
  
  $sql = "SELECT count(*) FROM clients WHERE client_id = :id";
  
  $results = $conn-&gt;executeQuery($sql, ['id' =&gt; 'foo'], ['id' =&gt; \PDO::PARAM_STR]);
  
  var_dump($results-&gt;fetchAll());
  var_dump($results-&gt;rowCount());
  </code></pre>
  
  <p>Which works fine returning:</p>
  
  <pre><code>array (size=1)
    0 =&gt; 
      array (size=1)
        'count(*)' =&gt; string '1' (length=1)
  int 1
  </code></pre>
  
  <p>However the code also works using the following lines (where the types parameters is declared incorrectly or not declared at all):</p>
  
  <pre><code>$results = $conn-&gt;executeQuery($sql, ['id' =&gt; 'foo'], ['id' =&gt; \PDO::PARAM_INT]);
  
  $results = $conn-&gt;executeQuery($sql, ['id' =&gt; 'foo'], ['notatag' =&gt; \PDO::PARAM_STR]);
  
  $results = $conn-&gt;executeQuery($sql, ['id' =&gt; 'foo']);
  </code></pre>
  
  <p>Suggesting the declaring the bound variable data type isn't being used, raising concerns as to if this is protected against SQL injection.</p>
  
  <p>Am I doing something wrong here? How can I be sure my code is secure?</p>