Re: Sanitizing mysql inserts of user data

>> $stmt = $db->prepare("SELECT priv FROM testUsers WHERE >> username=:username AND password=:password"); >> $stmt->bindParam(':username', $user); >> $stmt->bindParam(':password', $pass); >> $stmt->execute(); [8<] > I haven't followed this thread, so I don't know what you mean by, "I > do not see how there could possibly be a prepared statement for a user > comment." Maybe someone else can answer that part of your query. Thanks Paul, that was a much better explanation than the one I was attempting. I'm guessing the OP was being thrown off by the colons in the SELECT statement above. I can see how those could look like comments to someone not familiar with PDO and named parameters. Ben