title: How to add variable values inside pdo->query
body: <p>I want to upgrade my current code which is constantly sql injected with PDO. </p>
  
  <p>Currently I'm stuck with using a variable inside a PDO query.</p>
  
  <p>If I have two arguments like this</p>
  
  <pre><code>  $rowsPerPage = 3;
  
    // by default we show first page
    $pageNum = 1; 
  
    if (isset($_GET['page'])) {
       $pageNum = mysql_real_escape_string($_GET['page']);
    }
  
    $offset = ($pageNum - 1) * $rowsPerPage;
  </code></pre>
  
  <p>And I have query like this</p>
  
  <pre><code>$STH = $DBH-&gt;query("SELECT News.ID, LEFT(NewsText,650), Title, AID, Date, imgID," .
          "DATE_FORMAT(Date, '%d.%m.%Y.') as formated_date " .
          "FROM News, Categories, NewsCheck  WHERE Name LIKE '%News - Block%' AND CID=Categories.ID AND JID=News.ID ". 
          "ORDER BY `Date` DESC LIMIT $offset, $rowsPerPage");
  </code></pre>
  
  <p>PDO reports an error in last line of the query ORDER BY
  When I replace these line with 
   <code>"ORDER BY Date DESC LIMIT3,3");</code> everything work.</p>
  
  <p>So how to add variable values inside PDO::query ?</p>
  
  <p>Updated:
  Thanks to answer bellow I have updated my code like this</p>
  
  <pre><code>$STH = $DBH-&gt;prepare("SELECT News.ID, LEFT(NewsText,650), Title, AID, Date, imgID," .
              "DATE_FORMAT(Date, '%d.%m.%Y.') as formated_date " .
              "FROM News, Categories, NewsCheck  WHERE Name LIKE '%News - Block%' AND CID=Categories.ID AND JID=News.ID ". 
              "ORDER BY `Date` DESC LIMIT :offset, :rowsPerPage;");
  
  $STH-&gt;bindParam(':offset', $offset, PDO::PARAM_STR);
  $STH-&gt;bindParam(':rowsPerPage', $rowsPerPage, PDO::PARAM_STR);
  
  $STH-&gt;execute();
  </code></pre>
  
  <p>But error occured:</p>
  
  <blockquote>
    <p>Fatal error: Uncaught exception 'PDOException' with message
    'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an
    error in your SQL syntax; check the manual that corresponds to your
    MySQL server version for the right syntax to use near ''-3', '3'' at
    line 1' in /pdo/test.php:42 Stack trace: #0
    /pdo/test.php(42): PDOStatement->execute() #1 {main} thrown in
    /pdo/test..</p>
  </blockquote>
  
  <p><strong>Second Update</strong>
  Changed from PARAM_STR TO PARAM_INT like this</p>
  
  <pre><code>$STH-&gt;bindParam(':offset', $offset, PDO::PARAM_INT);
  $STH-&gt;bindParam(':rowsPerPage', $rowsPerPage, PDO::PARAM_INT);
  </code></pre>
  
  <p>Everything works.</p>