So I've been wondering for some time, after being advised in a [previous question](https://stackoverflow.com/questions/7755145/is-my-ip-in-my-database-if-so-find-timestamp) to use PDO prepared statements, why its important when connecting to my Database to use them in an instance like so?

eg using `$_SERVER['REMOTE_ADDR']`

I mean, if no one knows I'm using a database, and they have no idea what I'm looking for, and the thing I'm looking for in the database (assuming they know) is an IP address, why should it matter? Is this a matter of XSS attacks?

Genuine question. Never been able to find any reason to use PDO statements (or similar methods) in this instance. Surely I'm not vunerable?