code: protected function bindValues(
          /*# string */ $sql,
          array $settings
      )/*# : string */ {
          $bindings = &$this->bindings;
          $escape   = $this->getEscapeCallable($settings['escapeFunction']);
          $params   = $this->getBuilder()->getPlaceholderMapping();
  
          // real function
          $function = function($v) use ($settings, &$bindings, $escape) {
              // positioend parameters
              if ($settings['positionedParam']) {
                  $bindings[] = $v;
                  return '?';
  
              // named parameters
              } elseif ($settings['namedParam'] && isset($v[0]) && ':' == $v[0]) {
                  return $v;
  
              // use value, but NOT escaping int or float
              } elseif (is_numeric($v) && !is_string($v)) {
                  return $v;
  
              // use value, but escape it @todo boolean?
              } else {
                  return $escape($v);
              }
          };
  
          // replace placeholders with '?' or real value
          return preg_replace_callback(
              '/\b__PH_[0-9]++__\b/',
              function($m) use (&$params, $function) {
                  return $function($params[$m[0]]);
              }, $sql);
      }
docs: Replace placeholders in the SQL with '?' or real value
  
  @param  string $sql
  @param  array $settings current settings
  @return string replaced sql
  @access protected