title: What does bind_param accomplish?
body: <p>I'm learning about avoiding SQL injections and I'm a bit confused.</p>
  
  <p>When using bind_param, I don't understand the purpose. On the manual page, I found this example:</p>
  
  <pre><code>$stmt = mysqli_prepare($link, "INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");
  mysqli_stmt_bind_param($stmt, 'sssd', $code, $language, $official, $percent);
  
  $code = 'DEU';
  $language = 'Bavarian';
  $official = "F";
  $percent = 11.2;
  </code></pre>
  
  <p>Now, assuming those 4 variables were user-inputted, I don't understand how this prevents SQL injections. By my understanding, they can still input whatever they want in there.</p>
  
  <p>I also can't find an explanation for the <code>'sssd'</code> in there. What does it do? Is that what makes it secure-er?</p>
  
  <p>Final question: I read on another question that <code>mysqli_real_escape_string</code> is deprecated, but it doesn't say that in the manual. How is it deprecated? Can it not escape special characters anymore for some reason?</p>
  
  <p>Note: This question explained what bind_param does, but I still don't understand why it is any safer or more protected.
  <a href="https://stackoverflow.com/questions/10874644/bind-param-in-php">Bind_param explanation</a></p>