Can you tell me if Joomla SQL drivers support prepared statements? As far as I understand, the MySQLi driver does not prepare SQL statements. But Joomla also supports MySQL PDO driver. Does this driver prepare SQL statements? Is it safe to use Joomla SQL wrappers?
Joomla has its own database classes which are wrappers for PDO and other drivers.
Prepared statement were added for PDO/SQLite and Oracle somewhere in the early Joomla 3.x series I believe and can be achieved like so:
$db = JFactory::getDbo(); $query = $db->getQuery(true); $query->select($db->quoteName('something')) ->from($db->quoteName('#__table_name')) ->where($db->quote('foo') . ' = ' $db->quote('bar')); $query->bind(':s', $like); $db->setQuery($query); $records = $db->loadObjectList();