protected function bindValues(
        /*# string */ $sql,
        array $settings
    )/*# : string */ {
        $bindings = &$this->bindings;
        $escape   = $this->getEscapeCallable($settings['escapeFunction']);
        $params   = $this->getBuilder()->getPlaceholderMapping();

        // real function
        $function = function($v) use ($settings, &$bindings, $escape) {
            // positioend parameters
            if ($settings['positionedParam']) {
                $bindings[] = $v;
                return '?';

            // named parameters
            } elseif ($settings['namedParam'] && isset($v[0]) && ':' == $v[0]) {
                return $v;

            // use value, but NOT escaping int or float
            } elseif (is_numeric($v) && !is_string($v)) {
                return $v;

            // use value, but escape it @todo boolean?
            } else {
                return $escape($v);
            }
        };

        // replace placeholders with '?' or real value
        return preg_replace_callback(
            '/\b__PH_[0-9]++__\b/',
            function($m) use (&$params, $function) {
                return $function($params[$m[0]]);
            }, $sql);
    }