What is the difference between PDOStatement::bindParam() and PDOStatement::bindValue()?
For the most common purpose, you should use bindValue.
bindParam has two tricky or unexpected behaviors:
bindParam(':foo', 4, PDO::PARAM_INT) does not work, as it requires passing a variable (as reference).bindParam(':foo', $value, PDO::PARAM_INT) will change $value to string after running execute(). This, of course, can lead to subtle bugs that might be difficult to catch.Source: http://php.net/manual/en/pdostatement.bindparam.php#94711