Doubt in the security of PHP PDO

Question

I would like to know the difference in safety level between the two code snippets below:

// TRECHO 1
<?php
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit
    WHERE calories < ? AND colour = ?');
$sth->bindParam(1, $calories, PDO::PARAM_INT);
$sth->bindParam(2, $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>

// TRECHO 2
<?php
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit
    WHERE calories < ? AND colour = ?');
$sth->execute(array($calories,$colour));
?>

In section 1, the bindParam(), in 2 the parameters are passed directly in the execute, but also the prepare().

Answer 1

In terms of security there is no difference. One of the differences is that bindParam() in addition to offering parameter typing(PDO::PARAM_STR, PDO::PARAM_INT etc) has other obscure features for using stored procedures. See the method signature.

public bool Pdostatement::bindParam ( Mixed $Parameter , Mixed &$variable [, int $data_type = PDO::PARAM_STR [, int $length [, Mixed $driver_options ]]] )

When using the execute() all parameters are sent as PDO::PARAM_STR the most that can happen is your query fails if you have placeholder on the clasp LIMIT/OFFSET.

Related:

What is the difference between bindParam and bindValue?

Using PDO is the safest way to connect to a PHP BD?

Answer 2

Technically and theoretically, there’s no difference, because if you’re going to analyze, in the first case, where you used the bindParam, with symbolic type placeholders (?):

$sth->bindParam(1, $calories, PDO::PARAM_INT);

You used the number 1 as a reference to that placeholder.

Writing the parameters online, along with the method execute, you are doing nothing different, each value receives indexes according to the number of placeholders specified.

$sth->execute( array( 0 => 150, 1 => 'red' ) ); 

It would be the same as doing:

$params = array(150,'red');
$sth->execute($params);

If you still have questions, I recommend you read this:

• PDO::()