Bind parameters broken in 9.3?

my parameters look like this:

and date(t.created_at) >= ':DATETIME_M_from'

and date(t.created_at) >= :DATETIME_M_from

/* Bind parameters enabled */
/* Bind parameter detection... */
/* 0 bind parameters found. */
<typed some sql with a parameter...>
/* Bind parameter detection... */
/* 1 bind parameters found. */

select :hello

select foo;
select foo bar;

Bind parameters should be quoted, but they never were in HeidiSQL yet. So that's "normal" for now.

select :hello, ':world'

<?php
/* Execute a prepared statement by binding PHP variables */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < :calories AND colour = :colour');
$sth->bindParam(':calories', $calories, PDO::PARAM_INT);
$sth->bindParam(':colour', $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>

@Kalvaro, that's not how bind params work, unfortunately. In your example :hello and :world should be two bind parameters. Frequently you need to quote the bind param (e.g. for dates). In 20 years of using bind parameters in this way with Oracle and TOAD

I don't use TOAD but both Oracle SQL Developer and the OCI library itself (both of them official Oracle products) do it the way I suggested. The same happens with PHP libraries like PDO, MySQLi or SQLSRV. If you have to quote parameter values yourself, then prepared statements do not protect at all against SQL injection.