PDO MYSQL escape single quote in text

Question

I use this code (extract) to run an INSERT query to a MYSQL DB:

        try{
            $s = $pdo->prepare("INSERT INTO crediti SET
                nota = '$nota',
                scad_nota = '$data_nota',
                chiusa = '$nota_chiusa'
            ");
            $s->execute();
        }
        catch (PDOException $e){
            $error .= 'Errore nel caricare il credito: '.$e->getMessage();
            $table .= '<td class="report err" colspan="2">'.$error.'</td>';
            //aggiungo una riga in errore al conteggio
            $g = $g + 1;
            continue;
        }

$nota takes some text that can contains single quote like for example:

ceduto a Valentini nell'ottobre 2010

that as you can see contains a single quote between nell and ottobre (sorry for italian but the meaning is not in scope actually). How should I handle $nota to be able to insert it in the db? With my actual code it breaks for the reason of that single quote:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ottobre..

I have read a lot on SO and googling around. I have read this question and as far as I understand my code shouldn't have any problem. Any help?

Use bound parameters. That will fix this, as well as helping you write more secure code. — andrewsi, Apr 27 '15 at 18:03
http://php.net/pdo.prepared-statements or escape your data input(s). http://stackoverflow.com/q/60174/ - sarà molto bene ;-) *arriverderLa* — Funk Forty Niner, Apr 27 '15 at 18:03
@Fred-ii- you are right (also with your italian :) ). This specific query comes from a data load of financial data from excel into a mysql table for a intranet webapp. So I am confortable about sql injection this time. Thanks for the link! — Lelio Faieta, Apr 27 '15 at 18:08
*"(sorry for italian but the meaning is not in scope actually)"* - No problema, Ho capito bene ;-) — Funk Forty Niner, Apr 27 '15 at 18:12

PDO MYSQL escape single quote in text

0 Answers0