04-24-2012, 04:58 PM
Still i would prefer PDO over having to sanitize everything.
Why PDO is so good is because it sends the part in $db->prepare() to the database first.
Then after the mysql command is send, it will send the parameters. These parameters cant be querys on itself, and also wont be executed by the server under any circumstance.
Making it 100% safe against SQL injections without having to sanitize yourself.
But its of course a personal preference.
I learned when its about the game database or website that u can never be to cautious about security.
Sadly i had to learn it the hard way
