jei naudosi pdo bind'us tai nereikes tau rupintis del sql injections.
http://stackoverflow.com/questions/7615217/how-php-mysqli-prepared-statements-bind-params-protect-against-sql-injecti
<?php
/* Execute a prepared statement by binding PHP variables */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
FROM fruit
WHERE calories < :calories AND colour = :colour');
$sth->bindParam(':calories', $calories, PDO::PARAM_INT);
$sth->bindParam(':colour', $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>
http://php.net/manual/en/pdostatement.bindparam.php
