diff --git a/reference/pdo/pdo/prepare.xml b/reference/pdo/pdo/prepare.xml index 7ea653c0df..a41f137dc1 100644 --- a/reference/pdo/pdo/prepare.xml +++ b/reference/pdo/pdo/prepare.xml @@ -17,11 +17,11 @@ Prepares an SQL statement to be executed by the - PDOStatement::execute method. The SQL statement can + PDOStatement::execute method. The statement template can contain zero or more named (:name) or question mark (?) parameter markers for which real values will be substituted when the statement is executed. - You cannot use both named and question mark parameter markers within the same - SQL statement; pick one or the other parameter style. + Both named and question mark parameter markers cannot be used within the same + statement template; only one or the other parameter style. Use these parameters to bind any user-input, do not include the user-input directly in the query. @@ -44,9 +44,9 @@ PDOStatement::execute for statements that will be issued multiple times with different parameter values optimizes the performance of your application by allowing the driver to negotiate - client and/or server side caching of the query plan and meta information, - and helps to prevent SQL injection attacks by eliminating the need to - manually quote the parameters. + client and/or server side caching of the query plan and meta information. Also, calling PDO::prepare and + PDOStatement::execute helps to prevent SQL injection attacks by eliminating the need to + manually quote and escape the parameters. PDO will emulate prepared statements/bound parameters for drivers that do @@ -76,7 +76,7 @@ returns. You would most commonly use this to set the PDO::ATTR_CURSOR value to PDO::CURSOR_SCROLL to request a scrollable cursor. - Some drivers have driver specific options that may be set at + Some drivers have driver-specific options that may be set at prepare-time. @@ -107,7 +107,7 @@ &reftitle.examples; - Prepare an SQL statement with named parameters + SQL statement template with named parameters fetchAll(); - Prepare an SQL statement with question mark parameters + SQL statement template with question mark parameters