Prepared statement

Meaning

A prepared statement is a database query written with placeholders so that values are sent separately and treated only as data. The PHP manual says that if an application uses prepared statements exclusively, SQL injection cannot occur through those values, although other parts of a query built from unescaped input can still be risky. The query is parsed once and can be run many times with different values. Placeholders replace whole values only, so the wildcards of a LIKE search belong in the bound value. See also: PDO, SQL injection, and the guide PHP Security Basics: Validation, Prepared Statements and More.