$pdo = new Pdo('mysql:host=127.0.0.1;dbname=app', 'root');
$query = $pdo->prepare('SELECT * FROM accounts WHERE id = ?');
$result = $query->execute(array(2));
if (false !== $result) {
foreach ($query->fetchAll(PDO::FETCH_OBJ) as $row) {
echo $row->name, "\n";
}
}
I've been re-writing a lot of queries in the day job lately, and
noticed that older queries didn't make use of prepared statements.
They either accepted straight user input, or used some custom
method that tried to duplicate what mysql_real_escape_string or
prepared statements does.
So perhaps there's a lack of education in this, or perhaps
developers are lazy (cough).
But either way, here's a basic example of using a prepared statement to find an
account.