title: Using prepared statements with SQLite3 and PHP
body: <p>I'm trying to add data to a database using SQLite3 in PHP. I got it working without prepared statements but now I'm trying to make it safer. I'm not using PDO.</p>
  
  <p>So far the following code doesn't work. It just inserts the words ":name" and ":email" into the database, instead of what their bound values should be:</p>
  
  <pre><code>$smt = $db-&gt;prepare("insert into names (name, email) values (':name', ':email')");
  $smt-&gt;bindValue(':name', $var_name);
  $smt-&gt;bindValue(':email', $var_email);
  
  $var_name = ($_POST[post_name]);
  $var_email = ($_POST[post_email]);
  
  $smt-&gt;execute();
  </code></pre>
  
  <p>So I thought at first that this was because I have single quotes around <code>:name</code> and <code>:email</code> in the prepared statement. So I took those out. Now when I post the form, it just puts blank entries into the database, it doesn't insert the values of <code>$var_name</code> and <code>$var_email</code></p>
  
  <p>The statement <em>is</em> executing, it's just not binding the variables properly I don't think. What have I done wrong?</p>