Why use PDO?
mysql_* functions are getting old. For a long time now mysql_* has been at odds with other common SQL database programming interfaces. It doesn't support modern SQL database concepts such as prepared statements, stored procs, transactions etc... and it's method for escaping parameters with
mysql_real_escape_stringand concatenating into SQL strings is error prone and old fashioned. The other issue with mysql_* is that it has had a lack of attention lately from developers, it is not being maintained... which could mean things like security vulnerabilities are not getting fixed, or it may stop working altogether with newer versions of MySQL. Also lately the PHP community have seen fit to start a soft deprecation of mysql_* which means you will start seeing a slow process of eventually removing mysql_* functions altogether from the language (Don't worry this will probably be awhile before it actually happens!).
PDO has a much nicer interface, you will end up being more productive, and write safer and cleaner code. PDO also has different drivers for different SQL database vendors which will allow you to easily use other vendors without having to relearn a different interface. (though you will have to learn slightly different SQL probably). Instead of concatenating escaped strings into SQL, in PDO you bind parameters which is an easier and cleaner way of securing queries. Binding parameters also allow for a performance increase when calling the same SQL query many times with slightly different parameters. PDO also has multiple methods of error handling. The biggest issue I have seen with mysql_* code is that it lacks consistent handling, or no handling at all! With PDO in exception mode, you can get consistent error handling which will end up saving you loads of time tracking down issues.
PDO is enabled by default in PHP installations now, however you need two extensions to be able to use PDO: PDO, and a driver for the database you want to use like pdo_mysql. Installing the MySQL driver is as simple as installing the php-mysql package in most distributions.
Connecting to MySQL
new way: all you gotta do is create a new PDO object. PDO's constructor takes at most 4 parameters, DSN, username, password, and an array of driver options.
A DSN is basically a string of options that tell PDO which driver to use, and the connection details... You can look up all the options here PDO MYSQL DSN.
Note: If you get an error about character sets, make sure you add the charset parameter to the DSN. Adding the charset to the DSN is very important for security reasons, most examples you'll see around leave it out. MAKE SURE TO INCLUDE THE CHARSET!
You can also pass in several driver options as an array to the fourth parameters. I recommend passing the parameter which puts PDO into exception mode, which I will explain in the next section. The other parameter is to turn off prepare emulation which is enabled in MySQL driver by default, but really should be turned off to use PDO safely and is really only usable if you are using an old version of MySQL.
You can also set some attributes after PDO construction with the setAttribute method:
Consider your typical mysql_* error handling:
OR die is a pretty bad way to handle errors, yet this is typical mysql code. You can't handle die(); as it will just end the script abruptly and then echo the error to the screen which you usually do NOT want to show to your end users allowing nasty hackers discover your schema.
PDO has three error handling modes.
- PDO::ERRMODE_SILENT acts like mysql_* where you must check each result and then look at
$db->errorInfo();to get the error details.
- PDO::ERRMODE_WARNING throws PHP Warnings
- PDO::ERRMODE_EXCEPTION throws PDOException. In my opinion this is the mode you should use. It acts very much like
or die(mysql_error());when it isn't caught, but unlike
or die()the PDOException can be caught and handled gracefully if you choose to do so.
NOTE: you do not have to handle with try catch right away. You can catch it anytime that is appropriate. It may make more sense to catch it at a higher level like outside of the function that calls the PDO stuff:
or you may not want to handle the exception with try/catch at all, and have it work much like or die(); does. You can hide the dangerous error messages in production by turning display_errors off and just reading your error log.
Running Simple Select Statements
Consider the mysql_* code:
In PDO You can run such queries like this:
query()method returns a
PDOStatementobject. You can also fetch results this way:
Note the use of
fetchAll()code above. This tells PDO to return the rows as an associative array with the field names as keys. Other fetch modes like
PDO::FETCH_NUMreturns the row as a numerical array. The default is to fetch with PDO::FETCH_BOTH which duplicates the data with both numerical and associative keys. It's recommended you specify one or the other so you don't have arrays that are double the size! PDO can also fetch objects with
PDO::FETCH_OBJ, and can take existing classes with
PDO::FETCH_CLASS. It can also bind into specific variables with
bindColumnmethod. There are even more choices! Read about them all here: PDOStatement Fetch documentation.
Getting Row Count
Instead of using mysql_num_rows to get the number of returned rows you can get a
PDOStatementand do rowCount();
NOTE: Though the documentation says this method is only for returning affected rows from
DELETEqueries, with the PDO_MYSQL driver (and this driver only) you can get the row count for
SELECTqueries. Keep this in mind when writing code for multiple databases.
This is because MySQL's protocol is one of the very few that give this information to the client for
SELECTstatements. Most other database vendors don't bother divulging this information to the client as it would incur more overhead in their implementations.
Getting the Last Insert Id
Previously in mysql_* you did something like this.
With PDO you just do run the lastInsertId method.
Running Simple INSERT, UPDATE, or DELETE statements
Consider the mysql_* code.
for PDO this would look like:
Do the same for simple
INSERT statements as well
Running Statements With Parameters
So far we've only shown simple statements that don't take in any variables. These are simple statements and PDO has the shortcut methods
DELETEstatements. For statements that take in variable parameters, you should use bound parameter methods to execute your queries safely. Consider the following mysql_* code.
Man! that's a pain, especially if you have lots of parameters. This is how you can do it in PDO:
So what's going on here? The
preparemethod sends the query to the server, and it's compiled with the '?' placeholders to be used as expected arguments. The
executemethod sends the arguments to the server and runs the compiled statement. Since the query and the dynamic parameters are sent separately, there is no way that any SQL that is in those parameters can be executed... so NO SQL INJECTION can occur! This is a much better and safer solution than concatenating strings together.
NOTE: when you bind parameters, do NOT put quotes around the placeholders. It will cause strange SQL syntax errors, and quotes aren't needed as the type of the parameters are sent during
executeso they are not needed to be known at the time of
There's a few other ways you can bind parameters as well. Instead of passing them as an array, which binds each parameter as a String type, you can use
bindValueand specify the type for each parameter:
Now if you have lots of parameters to bind, doesn't all those '?' characters make you dizzy and are hard to count? Well, in PDO you can use named placeholders instead of the '?':
You can bind using
executewith an array as well:
INSERT, DELETE, UPDATE Prepared Queries
Prepared Statements for
DELETEare not different than
SELECT. But lets do some examples anyway:
Preparing Statements using SQL functions
You may ask how do you use SQL functions with prepared statements. I've seen people try to bind functions into placeholders like so:
This does not work, you need to put the function in the query as normal:
You can bind arguments into SQL functions however:
Also note that this does NOT work for LIKE statements:
So do this instead:
Note we used bindValue and not bindParam. Trying to bind a parameter by reference will generate a Fatal Error and this cannot be caught by PDOException either.
Executing prepared statements in a loop
Prepared statements excel in being called multiple times in a row with different values. Because the sql statement gets compiled first, it can be called multiple times in a row with different arguments, and you'll get a big speed increase vs calling mysql_query over and over again!
Typically this is done by binding parameters with
bindParamis much like
bindValueexcept instead of binding the value of a variable, it binds the variable itself, so that if the variable changes, it will be read at the time of
Here's an example of using transactions in PDO: (note that calling
beginTransaction()turns off auto commit automatically):