Prepared Statements

Quick Introduction

Prepared Statements is a single PHP idea you'll use in almost every backend project.

In this lesson you learn only prepared statements — not five topics at once. By the end you can write a small working example and explain it in an interview.

We connect each lesson to our course projects: Login System, Blog CMS, REST API, Inventory, Employee Management, and E-Commerce Backend.

Business Problem

You're building the Inventory Management. After a user signs in, you need prepared statements working correctly before storing data or showing a dashboard.

Without understanding Prepared Statements, the team ships bugs: wrong totals, broken sessions, or type errors that only appear in production. This lesson fixes that with one clear pattern you can copy into your project today.

Core Concept

• Prepared Statements is one focused idea — learn it before mixing with other PHP topics.
• Use it in PHP 8.3+ with declare(strict_types=1); at the top of every file.
• Our course project (Inventory Management) uses prepared statements in real handlers.
• Run small scripts with php file.php after each change — don't just read.
• Interviewers ask for a one-minute explanation plus a tiny code sample.

Syntax

Core syntax for Prepared Statements. Every keyword below appears in production PHP — Laravel and Symfony use the same primitives under the hood.

declare(strict_types=1);

Keywords: declare · strict_types · namespace

Step-by-Step Example

Run this script locally. Change one value, run again, and watch what changes.

<?php
declare(strict_types=1);

$pdo = new PDO('mysql:host=127.0.0.1;dbname=shop', 'app', 'secret', [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES   => false,
]);

// Never concatenate user input into SQL
$email = $_GET['email'] ?? 'user@example.com';

$stmt = $pdo->prepare('SELECT id, email, created_at FROM users WHERE email = :email LIMIT 1');
$stmt->bindValue(':email', $email, PDO::PARAM_STR);
$stmt->execute();

$user = $stmt->fetch();
echo $user ? json_encode($user) : 'Not found';

Line by line

1. — part of the prepared statements example; run the file to see the result.
2. declare(strict_types=1); — turns on strict type checking for this file.
3. $pdo = new PDO('mysql:host=127.0.0.1;dbname=shop', 'app', 'secret', [ — part of the prepared statements example; run the file to see the result.
4. PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, — part of the prepared statements example; run the file to see the result.
5. PDO::ATTR_EMULATE_PREPARES => false, — part of the prepared statements example; run the file to see the result.

Authenticated

Real-World Example

In the Inventory Management, prepared statements appears in a single request handler — not spread across ten files. Keep the example small, test it with php, then paste the pattern into your project branch.

<?php
declare(strict_types=1);

// TODO: Prepared Statements exercise for Inventory Management