Secure Functions in a Database Class
This may sound harsh, I meant to be friendly though :)

It's bad/unsafe/vulnerable. This type of situation comes around a lot, which is sort of understandable. However, what is your class really doing? It's essentially pointless to make this class. You've basically just put a class in a class without doing anything different! So actually what you've done is make things less secure.

You mentioned a "more dangerous" option of preparing the query. That would be a false assumption. Preparing queries are one of the largest features of the PDO and MySQLi interfaces. They're far from dangerous if used correctly.

It's hard to tell if what you're really doing is "secure" because the actual SQL handling functions you've left out.

Now that that's out of the way...

To improve your coding, you can:


Fix indentation
Pick a coding style and apply it. You want clean code, not messy. Here's Zend's styles, which is one I like to offer because it's easy to follow and apply.


Then you're code will be nice and tidy!



Hows 'bout that PHP now!

Starting from the top:

$host = 'mysql:host' . $this-&gt;_hostname ';dbname' . $this-&gt;_database;


Where are you getting $_hostname and $_database? Same with $_username and $_password. It's okay to add those in your question next time (just without the actual values!) :)

In you first try...catch you have a typo. The assignment to this-&gt;db should really be $this-&gt;db. I'm not sure why you didn't receive an error for that.

This

public function execute() {
    return $this-&gt;stmt-&gt;execute();
}


is a nice try, but what's it's point? It's really not useful at all. That's be another reason home-made DB access classes aren't so great. If you do keep it, is it being called by the caller? If not, then you could make it private at least.

In both results() and result(), you return the associative array (PDO::FETCH_ASSOC) which may not be the best idea. What if you want to change the format of return down the line? There's not one easy way to do this.

Speaking of those two functions, I suggest you changes their names. I almost started to write how you had to of the same function. It's hard to tell them apart is what I'm saying.



So overall, there are many database access classes that come with frameworks that actually do improve the safety and handling of databases, unfortunately it's difficult to replicate your own. Don't be discouraged though! It's not a simple task, Laravel has about 50 different classes + interfaces just to make sure connecting to the database is perfect!