Optionally make use of bound parameters in PDO query? - php

Question

I have a series of queries to loop through and execute using PDO.
The queries may make use of zero or more of the following 3 bound values, ":valA", ":valB" and ":valC".
At runtime I don't know which of these three parameter a query might use. But the values of these parameters will be the same for each query I loop through.
If I bind all three to a prepared query and the query does not make use of all the parameters, PDO will error.
I.e.
<?php
$stmt = $pdo->prepare('SELECT * FROM table WHERE col = :valA OR col = valB');
$stmt->execute(array(':valA' => 'a', ':valB' => 'b', ':valC' => 'c'); // Results in an error because the query does makes use of :valC.
Is there a method for binding a parameter without making it required to be used by a prepared query?
I thought I wuold be able to catch the exception and allow the code to resume, but the query won't execute regardless of the error mode set for PDO.
Note that this question is different to the suggested duplicate of, Ignore particular WHERE criteria. In that question, the query needed to be crafted to suit optional values supplied by a user. I this case, the values are hardcoded by the application, and the queries are stored in a database. The application does not know which params a query may make use of, so it needs to make them all available.
Obviously I can regex check for params, but it could be tripped up by a string that happen to contain the parameter name.
The queries could also be stored with additional properties to indicate which params it makes use of, but I would prefer to not have to do this.

Answer 1

There is a way to do this with PDO. The methods bindParam() and bindValue() return false or throw an exception if you try to bind to a parameter that doesn't appear in the query.
But it only works if you set:
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
Example:
$stmt = $pdo->prepare("INSERT INTO foo (test, boolcol) VALUES (:valA, :valB)");
if (!$stmt->bindParam("valA", $foo))
{
echo "error, no param 'valA'\n";
}
if (!$stmt->bindParam("valB", $foo))
{
echo "error, no param 'valB'\n";
}
if (!$stmt->bindParam("valC", $foo))
{
echo "error, no param 'valC'\n";
}
Outputs:
PHP Warning: PDOStatement::bindParam(): SQLSTATE[HY093]:
Invalid parameter number: parameter was not defined in /home/billkarwin/pdo.php on line 18
error, no param 'valC'
If you set $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); then it throws an exception instead of a warning, and you could wrap each bindParam() in a try/catch block:
PHP Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[HY093]:
Invalid parameter number: parameter was not defined' in /home/billkarwin/pdo.php:18
Stack trace:
#0 /home/billkarwin/pdo.php(18): PDOStatement->bindParam('valC', 'foo')
#1 {main}
thrown in /home/billkarwin/pdo.php on line 18