Prepared Php Statements Enable Emulation

Question

Are there any side effects to disabling emulation when using prepared statements with pdo? I use select * and limit the results that need to be processed as an int, not a string. I can do one of two things.

$conn->setAttribute( PDO::ATTR_EMULATE_PREPARES, false ); 

Or bind these variables explicitly with the parameter type:

 $stm = $pdo->prepare('SELECT * FROM table LIMIT ?, ?'); $stm->bindParam(1, $limit_from,PDO::PARAM_INT); $stm->bindParam(2, $per_page,PDO::PARAM_INT); $stm->execute(); $data = $stm->fetchAll(); 

Any pros or cons? Obviously, turning off emulation will save a lot of binding.

Answer 1

Prepared statements are a feature of the low-level database driver. The database first accepts the query structure and receives the variable parameters separately. Again, this is a feature actually supported by the database itself.

"Emulated prepares" means that you use the same API on the PHP side, with separate calls to prepare() and bind / execute , but that the PDO driver simply internally escapes and concatenates the rows, sends the old long SQL string to the database. The database cannot use its built-in parameterized query function.

Transforming emulated prepares PDO commands for using the built-in parameterized database query function. You should only enable / disable emulated provisioning if your database (-driver) does not support built-in parameterized queries. Emulated ones are prepared only to support the old database (-drivers), it does not change how you link the parameters in your PHP code.

Emulated drugs can reveal security flaws in certain circumstances, as well as all client-side outputs and concatenation. If the query and the data remain separated down to the database, these flaws are impossible.

Answer 2

No, there are no pluses or minuses worth mentioning.

Obviously turning off emulation will save a lot of binding.

Not so much. You can use the binding only for such cases with LIMIT and continue to use the lazy binding in execute() for all other cases even with emulation enabled.