6

New to PDO - do I need to escape arguments I'm passing into a PDO prepared statement (such as the following):

$_GET['name'] = "O'Brady";

$sth = $dbh->prepare("INSERT INTO users SET name = :name");
$sth->bindParam(':name', $_GET['name']);
$sth->execute();
Matthew
  • 7,605
  • 7
  • 39
  • 39

2 Answers2

11

No. Neither do you need any quotation marks around text strings. Just pass in the variables as they are and the MySQL driver will take care of the rest.

Emil Vikström
  • 90,431
  • 16
  • 141
  • 175
2

The PDO will build the query in a safe manner so you won't need to escape it.

Jeremy L
  • 7,686
  • 4
  • 29
  • 36