Is this a MySQLi function?

[Samishii23]

Hmm. I've found a code example, mind you from 2005 so it's probably out of date on its own... But I was wondering about it, and haven't been able to find it on PHP's document site.

I know using the ?'s is used in Prepared Statements, but I was wondering if this code block is still possible in current versions

$sql = 'INSERT INTO user (username,passwordHash) VALUES (?,?)';
$result = $db->query($sql, array($_POST['username'], $passwordHash));

Link. First code block.
Link

[Dormilich]

this code is at least nothing native to PHP, as both in MySQLi and PDO, Prepared Statements are invoked by ->prepare() and executed by ->execute(), you may bind the values before calling execute().

there is no information about the nature of the $db object (which is only meant for illustration), as the focus of the article was password hashing.

[Samishii23]

I understand, I was just hoping that I would be able to pass the parameters the way he did in his article. Thats all. Since my own searching did not reveal anything. I wanted to ask here in hopes someone could answer.

[Dormilich]

not sure about MySQLi, but you can pass an array of parameters directly to PDOStatement->execute(), although this implies the values to be strings (i.e. as type parameter, PDO::PARAM_STR will be passed, regardless whether that is true for the data type or the DB field type)

and to answer the question directly, you can pass your values like the guy in the article, though that requires you to write the appropriate Database Abstraction Layer (classes).

[Samishii23]

Thanks for you time! :)