title: Php pdo statement vs MsSQL escaping?
body: <p>Similar questions have probably been asked before, and sry for that. Need to be sure that i protect from SQL injections correct.</p>
  
  <p>I have just converted my php sql statments to pdo statments. For the old sql queries I used to use <code>mysql_real_escape_string</code>, <code>strip_tags()</code>, and maybe <code>htmlenteties()</code>(not sure if  id did html). </p>
  
  <p>Is it necessery to use anything like this in the pdo statments. Have heard some places that this is not necessary in pdo. Whats true/false ?</p>
  
  <p>And: I have always used to write the queries like the first example below:</p>
  
  <pre><code>SELECT `id` , `password` FROM  `users` WHERE `username` = '$username'
  SELECT id, password FROM users WHERE username = '$username'
  </code></pre>
  
  <p>Is the example 1 more safer(from sql injections) than example 2 or is it just wasted time doing it ?</p>