I have a class for database management, and one of my sub-classes (the one that defines a query) is defined like this (just a sample, many other functions are actually stripped for testing purposes):

```
namespace Tests\SQL\Arguments {
    // SQL query
    class Query {
        public $attributes;

        // constructor for this object
        public function __construct() {
            if ($arguments = func_get_args()) {
                $this->attributes["query"] = current($arguments);

                if (sizeof($arguments) > 1) {
                    $this->attributes["parameters"] = array_slice($arguments, 1, sizeof($arguments));
                }

                return $this;
            }
        }
    }

    $query = new Query("INSERT INTO `clients/history` (`date`,`client`,`ammount`,`status`) VALUES (?,?,?,?);", date("Y-m-d H:i:s"), 57, 17852.25, "A");
    print_r($query);
}

```

As you can see, I automatically pick up the function arguments, so I can separate the query from its paremeters with ease at construction time. Apart from bulk `INSERT/UPDATE/DELETE` actions, I would like to provide some security, like preventing SQL injections and other things.

My question is... given this structure, when I pass this structure like (*just a simple example, it will be run in a different way, but this one is valid for the time being*):

```
$this->queries["clients/history"]->execute($this->attributes["query"], $this->attributes["parameters"]);

```

Will there be any different in using named parameters like `(:date,:client,:ammount,:status)` or using question mark parameters like `(?,?,?,?)`?

**EDIT - Better explanation**

Sorry for the (apparent) obscureness my question poses. My intention is to have a mechanism similar to sprintf but, instead of storing a string with all parameters composed into it, I just store the query and the parameters in a separate fashion.

This is just the Query class. There's also the QueryGroup class (for storing queries in groups), the Manager class (which stores and manages all database connections) and the Connection class (which is responsible for holding together all queries and query groups for a given database connection.

About the named parameters, I see no problem with the method I'm using, as this works, like I said, like the `sprintf` function. I'll be providing either question marks or the parameters' names in the query string.

I want to make a separation to provide addition filtering capabilities like escaping or quoting parameters to prevent some forms of injection or sabotage against a given database.

The `execute()` method I've exposed is just a paper-copy of PDO's `execute()` method. What I try to determine is if it's equally 'safe' to use named parameters or question mark parameters (or maybe there's some differences I'm not seeing there).

Any hint would be greatly appreciated :)