title: PDO::exec() expects parameter 1 to be string, object given when using prepared statements
body: <p>I am trying to protect against SQL-injections by using prepared statements. </p>
  
  <p>The following code shows the function that is called when a new user is created. The code that is commented out did work but was unsafe. Therefore, I tried changing it, but am getting the following error: </p>
  
  <blockquote>
    <p>PDO::exec() expects parameter 1 to be string, object given</p>
  </blockquote>
  
  <p>Here is the code:</p>
  
  <pre><code>function save()
  {
      if ($this-&gt;id === null) {
          $query = self::$app-&gt;db-&gt;prepare(self::INSERT_QUERY);
          $query-&gt;bindParam(1, $this-&gt;username);
          $query-&gt;bindParam(2, $this-&gt;password);
          $query-&gt;bindParam(3, $this-&gt;email);
          $query-&gt;bindParam(4, $this-&gt;bio);
          $query-&gt;bindParam(5, $this-&gt;isAdmin);
  
          //$query = sprintf(self::INSERT_QUERY,
           //   $this-&gt;username,
           //   $this-&gt;password,
           //   $this-&gt;email,
           //   $this-&gt;bio,
           //   $this-&gt;isAdmin            );
      } else {
        $query = sprintf(self::UPDATE_QUERY,
              $this-&gt;username,
              $this-&gt;password,
              $this-&gt;email,
              $this-&gt;bio,
              $this-&gt;isAdmin,
              $this-&gt;id
          );
      }
  
      return self::$app-&gt;db-&gt;exec($query);
  }
  </code></pre>
  
  <p>I am really new to both PHP and security, so any hints would be greatly appreciated!</p>