note 106783 deleted from pdo.quote by thiago

Note Submitter: onyn ---- Documentation strongly recommended to use PDO::prepare() instead of PDO::quote(). But this approach may cause performance impact on highload. Because it doubles total number of requests to db server. One for prepare stage and one for execute stage for each prepared query. PDO::prepare() is good for huge series of similar queries with different data. You may use PDO::ATTR_EMULATE_PREPARES to workaround double request "problem". Eg: <?php $db = new PDO( 'mysql:host=localhost;dbname=shop', 'dbuser', 'p@ssw0rd', array( PDO::ATTR_EMULATE_PREPARES => true ) ); $prep = $db->prepare('INSERT INTO users (username, password) VALUES(?, ?)'); $prep->execute(array('Bob', 'Hello" DROP TABLE credit_cards --')); ?> If server doesn't support prepared statements, PDO automatically fallback to emulated prepares mechanism.