How secure is this PDO Portfolio Script? I was wondering if someone could take some time to look over my portfolio script and see let me know if it's secure enough to be uploaded live and connected to my database. My previous mySQL script was VERY insecure...

The Database Connection:
    

    public function  __construct($server, $databaseName, $username, $password)
    {
        $this-&gt;server = $server;
        $this-&gt;databaseName = $databaseName;
        $this-&gt;username = $username;
        $this-&gt;password = $password;
        $this-&gt;openConnection();
    }

    protected function openConnection()
    {
        $this-&gt;databaseLink = new PDO("mysql:host=$this-&gt;server;dbname=$this-&gt;databaseName", $this-&gt;username, $this-&gt;password);
    }

    public function getLink()
    {
        return $this-&gt;databaseLink;
    }
}

$database = new Database("localhost", "XXXXXXX", "XXXXXXX", "XXXXXXX");
$databaseLink = $database-&gt;getLink();
?&gt;


The Client Detail Page
    

$client = $_GET["client"];

$getClientDataSql = "SELECT * FROM `client` WHERE `client`=:client";
$statement = $databaseLink-&gt;prepare($getClientDataSql);
$statement-&gt;bindParam(":client", $client, PDO::PARAM_STR);
$statement-&gt;execute();

if(!$statement-&gt;rowCount())
{
    echo "No Clients Found";
}
else
{
    $row = $statement-&gt;fetch(PDO::FETCH_ASSOC);

    // Title
    echo "&lt;div id='portfolio_detail'&gt;";
    echo "&lt;h3&gt;".$row["title"]."&lt;/h3&gt;";
    echo "&lt;div class='portfolio_block'&gt;".$row["description"]."&lt;/div&gt;";

    // Tags
    $tags = explode(",", $row["tags"]);
    if (count($tags))
    {
        echo "&lt;div class='portfolio_block'&gt;";
    foreach ($tags as $tag)
        {
            echo "&lt;span class='tag'&gt;".$tag."&lt;/span&gt;";
    }
        echo "&lt;/div&gt;";
    }

    // Colours
    $colours = explode(",", $row["colours"]);
    if (count($colours))
    {
        echo "&lt;div class='portfolio_block'&gt;&lt;h3&gt;Colours&lt;/h3&gt;";
    foreach ($colours as $colour)
    {
            echo "&lt;div class='colour_block' id='".$colour."' alt='".$colour."' title='".$colour."'&gt;&lt;/div&gt;";
    }
    echo "&lt;/div&gt;";
    }

    // Services
    $services = explode(",", $row["services"]);
    if (count($services))
    {
        echo "&lt;div class='portfolio_block'&gt;&lt;h3&gt;Services&lt;/h3&gt;&lt;ul&gt;";
    foreach ($services as $service)
    {
            echo "&lt;li id='".$service."'&gt;".$service."&lt;/li&gt;";
    }
    echo "&lt;/ul&gt;&lt;/div&gt;";
    }
    echo "&lt;div class='portfolio_visit'&gt;&lt;a href='".$row["visit"]."'&gt;Visit Website&lt;/a&gt;&lt;/div&gt;";
    echo "&lt;/div&gt;";
    echo "&lt;div id='portfolio_detail_img'&gt;&lt;img src='"."/client/".$row["client"].".png"."' alt='".$row["client"]."' title='".$row["client"]."' /&gt;&lt;/div&gt;";
    echo "&lt;div id='portfolio_detail_slide' class='rsMinB'&gt;";
    echo "&lt;div&gt;&lt;img src='"."/client/".$row["client"]."_1.png"."' /&gt;&lt;/div&gt;";
    echo "&lt;div&gt;&lt;img src='"."/client/".$row["client"]."_2.png"."' /&gt;&lt;/div&gt;";
    echo "&lt;div&gt;&lt;img src='"."/client/".$row["client"]."_3.png"."' /&gt;&lt;/div&gt;";
    echo "&lt;/div&gt;";
}

?&gt;


The Client List Page
    

$getPortofolioDataSql = "SELECT `id`, `title`, `description`, `client` FROM `client`";
$statement = $databaseLink-&gt;prepare($getPortofolioDataSql);
$statement-&gt;execute();
if($statement-&gt;rowCount() == 0)
{
    echo "No Portfolio Found";
}
else
{
    while($portofolioDetails = $statement-&gt;fetch(PDO::FETCH_ASSOC))
    {
        echo "&lt;li class='portfolio'&gt;";
    echo "&lt;a href='portfolio/".$portofolioDetails["client"]."'&gt;&lt;img src='http://www.creativewebgroup.co.uk/client/".$portofolioDetails["client"].".png' /&gt;&lt;/a&gt;";
        echo "&lt;/li&gt;";
    }
}
?&gt;
Your database queries are using bound parameters with prepared statements. Good.
You need to escape your output.


Other observations:


Your Database class adds nothing (unless you've abbreviated it here for simplicity?). Consider simply using PDO.
You have no error handling. Try loading your page with incorrect db credentials and see what I mean.
Consider using markup with php instead of string-ified markup in php. It is much easier to read and maintain.