The 'Query Bind' Method

The 'Query Bind' method executes custom SQL queries.  Unlike, the 'Query' method, this method uses PDO query binding which makes SQL injection impossible - provided you use the method properly.

The following parameters can be accepted by the 'Query Bind' method:

• $sql (required) - the SQL query that you would like to execute on your database.
• $params (required) - an array of key, value pairs that can be safely used by PDO to replace placeholder values.
• $return_type (option) - the data type for table rows that are returned from the query.  Acceptable values for this are 'object' and 'array'.

What Gets Returned?

WHEN MATCHING RECORDS ARE FOUND

If matching records are found then a PHP array will be returned where each item on the array represents a row from a database table. Each row, within the array, will either be a PHP object or a PHP array.

WHEN MATCHING RECORDS ARE NOT FOUND

If the SQL query produces no results then an empty array will be returned.

Example 1

The syntax below shows an example of query binding using named parameters.

function test() {
    $params['first_name'] = 'Starsky';

    $sql = 'SELECT *
            FROM members
            WHERE first_name = :first_name';

    $rows = $this->model->query_bind($sql, $params, 'object');
    json($rows);
}

The code above will produce the following SQL query:

SELECT * FROM members WHERE first_name = 'Starsky'

Example 2

Below is an example of query binding using unnamed parameters:

​

​function test() {
​    $params[] = 'Starsky';
    $params[] = 'Star';

​    $sql = 'SELECT *
            FROM members
            WHERE first_name = ?
            AND last_name = ?';

​    $rows = $this->model->query_bind($sql, $params, 'object');
​    json($rows);
​}
​

The code above would produce the following SQL query:

​SELECT * FROM members WHERE first_name = 'Starsky' and last_name = 'Star'​