Binding parameters in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of prepared statement with bound parameters

What is the output of this PHP code snippet that uses PDO to bind parameters and execute a query?

PHP

<?php
$pdo = new PDO('sqlite::memory:');
$pdo->exec('CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT)');
$pdo->exec("INSERT INTO users (name) VALUES ('Alice'), ('Bob')");
$stmt = $pdo->prepare('SELECT name FROM users WHERE id = :id');
$id = 2;
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();
echo $stmt->fetchColumn();
?>

A Alice

B SyntaxError

C NULL

D Bob

💡 Hint

Remember that bindParam binds the variable by reference and the value of $id is 2.

The query selects the user with id = 2, which is 'Bob'. The bindParam binds the variable $id by reference, so the value 2 is used when executing.

❓ Predict Output

intermediate

Effect of changing variable after bindParam

What will this PHP code output when using bindParam and changing the variable after binding but before execution?

PHP

<?php
$pdo = new PDO('sqlite::memory:');
$pdo->exec('CREATE TABLE items (id INTEGER PRIMARY KEY, name TEXT)');
$pdo->exec("INSERT INTO items (name) VALUES ('Pen'), ('Pencil')");
$stmt = $pdo->prepare('SELECT name FROM items WHERE id = :id');
$id = 1;
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$id = 2;
$stmt->execute();
echo $stmt->fetchColumn();
?>

A NULL

B Pencil

C Pen

D Fatal error

💡 Hint

bindParam binds by reference, so the value at execution time matters.

Because bindParam binds the variable by reference, changing $id to 2 before execute means the query uses id=2, which corresponds to 'Pencil'.

🔧 Debug

advanced

Why does this bindValue code not update with variable change?

Consider this PHP code using bindValue. Why does changing the variable after binding not affect the executed query?

PHP

<?php
$pdo = new PDO('sqlite::memory:');
$pdo->exec('CREATE TABLE products (id INTEGER PRIMARY KEY, name TEXT)');
$pdo->exec("INSERT INTO products (name) VALUES ('Table'), ('Chair')");
$stmt = $pdo->prepare('SELECT name FROM products WHERE id = :id');
$id = 1;
$stmt->bindValue(':id', $id, PDO::PARAM_INT);
$id = 2;
$stmt->execute();
echo $stmt->fetchColumn();
?>

A bindValue copies the value at binding time, so changing $id later has no effect.

B bindValue binds by reference, so the query uses the updated $id value.

C The code throws a runtime error because $id is changed after binding.

D The query returns NULL because bindValue requires execute parameters.

💡 Hint

bindValue copies the value immediately, unlike bindParam.

bindValue binds the value at the time of binding, so changing the variable later does not affect the query. The query uses id=1 and returns 'Table'.

📝 Syntax

advanced

Identify the syntax error in this bindParam usage

Which option shows the correct way to bind a parameter using bindParam in PHP? The others contain syntax errors.

A $stmt->bindParam(':name', $name, PDO::PARAM_STR);

B $stmt->bindParam(':name' $name, PDO::PARAM_STR);

C $stmt->bindParam(:name, $name, PDO::PARAM_STR);

D $stmt->bindParam(':name', $name PDO::PARAM_STR);

💡 Hint

Check for missing commas and quotes around parameter names.

Option A correctly uses quotes around ':name' and commas between arguments. Options B, C, and D have missing commas or missing quotes causing syntax errors.

🚀 Application

expert

How many rows will be updated with this bindParam loop?

Given this PHP code that updates multiple rows using bindParam inside a loop, how many rows will be updated after execution?

PHP

<?php
$pdo = new PDO('sqlite::memory:');
$pdo->exec('CREATE TABLE scores (id INTEGER PRIMARY KEY, score INTEGER)');
$pdo->exec("INSERT INTO scores (score) VALUES (10), (20), (30)");
$stmt = $pdo->prepare('UPDATE scores SET score = :score WHERE id = :id');
$stmt->bindParam(':score', $score, PDO::PARAM_INT);
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
for ($i = 1; $i <= 3; $i++) {
    $id = $i;
    $score = $i * 100;
    $stmt->execute();
}
$count = $pdo->query('SELECT COUNT(*) FROM scores WHERE score >= 100')->fetchColumn();
echo $count;
?>

A 0

B SyntaxError

C 3

D 1

💡 Hint

bindParam binds variables by reference, so changing them in the loop affects each execute call.

The loop updates each row with id 1, 2, and 3, setting scores to 100, 200, and 300 respectively. All three rows have score >= 100 after the loop, so the count is 3.

Practice

1. What is the main purpose of binding parameters in PHP database queries?

easy

A. To format the output of SQL query results

B. To speed up the execution of SQL queries

C. To safely add user input to SQL queries and prevent SQL injection

D. To create new database tables automatically

Solution

1. Step 1: Understand the role of binding parameters

   Binding parameters link user input safely to SQL queries, avoiding direct insertion of data.

2. Step 2: Recognize the security benefit

   This prevents SQL injection attacks by separating code from data.

3. Final Answer:

   To safely add user input to SQL queries and prevent SQL injection -> Option C

4. Quick Check:

   Binding parameters = prevent SQL injection [OK]

Hint: Binding parameters protect queries from unsafe user input [OK]

Common Mistakes:

• Thinking binding parameters speed up queries
• Confusing binding with output formatting
• Believing binding creates database tables

2. Which of the following is the correct way to bind a parameter by reference using PDO in PHP?

easy

A. $stmt->bindParam(':id', $id, PDO::PARAM_INT);

B. $stmt->bind(':id', $id, PDO::PARAM_INT);

C. $stmt->bindParameter(':id', $id, PDO::PARAM_INT);

D. $stmt->bindValue(':id', $id, PDO::PARAM_INT);

Solution

1. Step 1: Identify the correct PDO method for binding parameters

   The correct method to bind a variable by reference is bindParam.

2. Step 2: Check the syntax

   bindParam takes the placeholder, variable, and type as arguments exactly as in $stmt->bindParam(':id', $id, PDO::PARAM_INT);.

3. Final Answer:

   $stmt->bindParam(':id', $id, PDO::PARAM_INT); -> Option A

4. Quick Check:

   bindParam syntax = $stmt->bindParam(':id', $id, PDO::PARAM_INT); [OK]

Hint: bindParam binds variables by reference, syntax matters [OK]

Common Mistakes:

• Using bind instead of bindParam
• Confusing bindParam with bindValue
• Wrong method names like bindParameter

3. What will be the output of the following PHP code?

$id = 5;
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$id = 10;
$stmt->execute();
$result = $stmt->fetchAll();
print_r($result);

medium

A. Results for id = 5

B. Results for id = 10

C. Syntax error

D. Empty result

Solution

1. Step 1: Understand bindParam binds by reference

   bindParam links the variable $id by reference, so changes to $id affect the bound value.

2. Step 2: Check variable change before execute

   $id is changed to 10 before execute(), so the query uses id = 10.

3. Final Answer:

   Results for id = 10 -> Option B

4. Quick Check:

   bindParam binds by reference = Results for id = 10 [OK]

Hint: bindParam uses current variable value at execute time [OK]

Common Mistakes:

• Assuming bindParam uses value at bind time
• Confusing bindParam with bindValue
• Expecting syntax error from this code

4. Identify the error in this PHP code snippet using PDO binding:

$stmt = $pdo->prepare('SELECT * FROM users WHERE name = :name');
$name = 'Alice';
$stmt->bindParam(':name', $name);
$name = 'Bob';
$stmt->execute();

medium

A. No error, code works correctly

B. Binding happens after changing $name variable

C. Missing PDO::PARAM_STR in bindParam call

D. Placeholder :name should be replaced manually

Solution

1. Step 1: Check bindParam usage

   bindParam can omit the type parameter; it defaults to PDO::PARAM_STR for strings.

2. Step 2: Understand variable binding by reference

   Changing $name before execute() updates the bound value, so 'Bob' is used.

3. Final Answer:

   No error, code works correctly -> Option A

4. Quick Check:

   bindParam without type is valid = No error, code works correctly [OK]

Hint: bindParam type is optional for strings [OK]

Common Mistakes:

• Thinking type is mandatory in bindParam
• Expecting manual placeholder replacement
• Assuming binding after variable change is error

5. You want to insert multiple user records safely using PDO and binding parameters. Which approach correctly binds parameters inside a loop to insert each user?

$users = [['name' => 'Anna', 'age' => 25], ['name' => 'Ben', 'age' => 30]];
$stmt = $pdo->prepare('INSERT INTO users (name, age) VALUES (:name, :age)');
foreach ($users as $user) {
    // What is the correct way to bind and execute here?
}

hard

A. Bind parameters once before loop, then change variables inside loop and execute

B. Concatenate values into SQL string inside loop and execute

C. Bind parameters inside loop using bindParam, then execute

D. Use bindValue inside loop for each value, then execute

Solution

1. Step 1: Understand bindParam vs bindValue in loops

   bindParam binds variables by reference, which can cause issues if variables change in loop.

2. Step 2: Use bindValue to bind actual values each iteration

   bindValue binds the current value, safe for repeated execution in loops.

3. Final Answer:

   Use bindValue inside loop for each value, then execute -> Option D

4. Quick Check:

   bindValue in loop = safe repeated binding [OK]

Hint: Use bindValue in loops to bind current values safely [OK]

Common Mistakes:

• Binding once with bindParam and changing variables
• Concatenating values directly risking SQL injection
• Binding inside loop with bindParam causing reference issues