What does this mean?

Question

I found this in some code examples while googling :

$sql = 'INSERT INTO users (username,passwordHash) VALUES (?,?)';

it's new to me, but I would guess that it a substitution method and equivalent to

$sql = "INSERT INTO users (username,passwordHash) VALUES ($username,$passwordHash)";` 

or

$sql = 'INSERT INTO users (username,passwordHash) VALUES (' . $username . ',' . $passwordHash . ')';`

would that be correct? Is it an actual PHP syntax, or was he just trying to simplify his example?

---

Thanks for the feedback, folks

Answer 1

This is pretty common in prepared statements. The ? merely serves as a placeholder, as seen below from the PHP documentation:

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (?, ?)");
$stmt->bindParam(1, $name);
$stmt->bindParam(2, $value);

// insert one row
$name = 'one';
$value = 1;
$stmt->execute();

// insert another row with different values
$name = 'two';
$value = 2;
$stmt->execute();