Binding parameters in PHP - Mini Project: Build & Apply

Binding parameters

📖 Scenario: You are creating a simple PHP script to insert user data into a database safely using prepared statements and binding parameters.

🎯 Goal: Build a PHP script that prepares an SQL statement, binds parameters to it, and executes the statement to insert data into a database.

📋 What You'll Learn

Create a PDO connection variable called $pdo

Prepare an SQL insert statement with placeholders

Bind parameters using bindParam

Execute the prepared statement

Print a success message after execution

💡 Why This Matters

🌍 Real World

Binding parameters is a common way to safely insert or update data in databases, preventing SQL injection attacks.

💼 Career

Understanding prepared statements and parameter binding is essential for backend developers working with databases in PHP.

1

Create PDO connection

Create a PDO connection variable called $pdo connecting to a MySQL database named testdb on localhost with username root and password password.

PHP

<?php
// Create PDO connection
// Your code here

Need a hint?

Use new PDO() with the DSN string and credentials.

2

Prepare SQL statement

Use the $pdo variable to prepare an SQL insert statement into a table called users with columns name and email. Use named placeholders :name and :email. Store the prepared statement in a variable called $stmt.

PHP

<?php
$pdo = new PDO('mysql:host=localhost;dbname=testdb', 'root', 'password');
// Prepare SQL insert statement with named placeholders
// Your code here

Need a hint?

Use $pdo->prepare() with the SQL string containing :name and :email placeholders.

3

Bind parameters

Bind the variable $name to the :name placeholder and $email to the :email placeholder using bindParam on the $stmt variable. Set $name to 'Alice' and $email to '[e-mail]' before binding.

PHP

prepare('INSERT INTO users (name, email) VALUES (:name, :email)');
// Set variables and bind parameters
// Your code here

Need a hint?

Assign values to $name and $email first, then bind them with bindParam.

4

Execute statement and print result

Execute the prepared statement stored in $stmt using execute(). Then print the message "User inserted successfully".

PHP

prepare('INSERT INTO users (name, email) VALUES (:name, :email)');
$name = 'Alice';
$email = '[e-mail]';
$stmt->bindParam(':name', $name);
$stmt->bindParam(':email', $email);
// Execute the statement and print success message
// Your code here

Need a hint?

Call $stmt->execute() and then print the success message.