PDO with INSERT INTO through prepared statements

You should be using it like so Prepared statements are used to sanitize your input, and to do that you can use :foo without any single quotes within the SQL to bind variables, and then in the execute() function you pass in an associative array of the variables you defined in the SQL statement. You may also use ? instead of :foo and then pass in … Read more