New to PDO - do I need to escape arguments I'm passing into a PDO prepared statement (such as the following):
$_GET['name'] = "O'Brady";
$sth = $dbh->prepare("INSERT INTO users SET name = :name");
$sth->bindParam(':name', $_GET['name']);
$sth->execute();
推薦答案
沒有.文本字符串周圍也不需要任何引號.只需按原樣傳入變量，MySQL 驅動程序將負責其余的工作.
No. Neither do you need any quotation marks around text strings. Just pass in the variables as they are and the MySQL driver will take care of the rest.
