note 53625 added to function.pdo-quote

Since the manual is not entirely clear, using ::quote() is really not required if you use the recommended prepared statements: <?php $st = $pdo->prepare( "insert into Foo ( bar ) values( :bar )" ); $st->bindParam( ":bar", $bar, PDO_PARAM_STR ); $st->execute(); ?> is safe without using quote() on $bar. PDO will select the correct quoting method for your SQL driver. Note that you should still do your own checking for proper wildcard characters such as % and _. Doing a select ... where email=:email could be dangerous if the user passes % as their e-mail address. ---- Manual Page -- http://www.php.net/manual/en/function.pdo-quote.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+53625 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+53625&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+53625&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+53625&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+53625&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+53625&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+53625&report=yes Search -- http://master.php.net/manage/user-notes.php