$pdo = new Pdo('mysql:host=127.0.0.1;dbname=app', 'root');
$query = $pdo->prepare('SELECT * FROM accounts WHERE id = ?');
$result = $query->execute(array(2));
if (false !== $result) {
foreach ($query->fetchAll(PDO::FETCH_OBJ) as $row) {
echo $row->name, "\n";
}
}
I've been re-writing a lot of queries in the day job lately, and noticed that older queries didn't make use of prepared statements. They either accepted straight user input, or used some custom method that tried to duplicate what mysql_real_escape_string or prepared statements does.
So perhaps there's a lack of education in this, or perhaps developers are lazy (cough).
But either way, here's a basic example of using a prepared statement to find an account.