这个PDO绑定功能出了什么问题？

Question

I am trying to simplify my database functions by creating my own class.
one of these functions is bind. it worked before but now it does some strange things
The code is:

protected function tInsert(&$connection, $table, $data, $replaceSpecials){
    $sql = $this->createSqlQuery($table, $data);

    $stmt = $connection->prepare($sql);

    /* THIS WORKS
    $stmt->bindParam(":username", $data["username"]);
    $stmt->bindParam(":pass_hash", $data["pass_hash"]);
    $stmt->bindParam(":salt", $data["salt"]);
    $stmt->bindParam(":email", $data["email"]);
    $stmt->bindParam(":sex", $data["sex"]);
    $stmt->bindParam(":birthday", $data["birthday"]);
    $stmt->bindParam(":code", $data["code"]);
    */

    // THIS DOESNT
    $stmt = $this->bind($stmt, $data, $replaceSpecials);

    $stmt->execute();
}

private function bind($stmt, $data, $replaceSpecials){
    if ($replaceSpecials)
        foreach($data as $k => $d){
            $d = str_replace("<", "&lt;",
                str_replace(">", "&gt;", $d));
            $stmt->bindParam(":" . $k, $d);
        }

    else if (!$replaceSpecials)
        foreach($data as $k => $d) 
            $stmt->bindParam(":" . $k, $d);

    else return $this->bind($stmt, $data, false);
    return $stmt;
}

I am certain I formatted my data correctly.
the commented out section works, while when i try it with my custom bind function it doesnt work.
It worked before on other functions..
also it's not the sql query.. i'm certain it's in the bind function somewhere.

my final result is that EVERY column is filled with the last given parameter.
(in this context that would be :code)

e.g. this array is data

array (size=7)
  'salt' => string 'b3d7201e14' (length=10)
  'username' => string 'mister x' (length=8)
  'pass_hash' => string 'd930f9a672bd12c9cf94aff748ca5bd100139bd5bdc7fafbdbfc8ad4bd79ba3c' (length=64)
  'email' => string '[e-mail]' (length=23)
  'sex' => string 'm' (length=1)
  'birthday' => string '25-11-1992' (length=10)
  'code' => string '1ad21a5596cb556' (length=15)

The sql query generated:

INSERT INTO temp_users (salt, username, pass_hash, email, sex, birthday, code) 
VALUES(:salt, :username, :pass_hash, :email, :sex, :birthday, :code)

Answer 1

Replace bindParam() with bindValue(). bindParam defines a variable name to be used for the execution of the query. So, when your loop is over all variables are bound to $d, which at the point of the execution of the query has the value of the last iteration.

By changing this to bindValue() you are setting the value $d holds at the time of the function call.