OOP PDO Database Connection I'm currently learning about PDO, and trying to connect to the database and CRUD in OOP way, this is a simple code that I use.

index.php

include_once("connection.php");
include_once("model.php");

$con    = new Connection();
$model  = new Model();

$model-&gt;insert();
$con-&gt;closeConnection();


connection.php

class Connection {

    protected $host = "localhost";
    protected $dbname = "pdo";
    protected $user = "root";
    protected $pass = "";
    protected $DBH;

    function __construct() {

        try {

            $this-&gt;DBH = new PDO("mysql:host=$this-&gt;host;dbname=$this-&gt;dbname", $this-&gt;user, $this-&gt;pass);
        }
        catch (PDOException $e) {

            echo $e-&gt;getMessage();
        }
    }

    public function closeConnection() {

        $this-&gt;DBH = null;
    }
}


model.php

class Model extends Connection {

    public function insert() {

        $STH = $this-&gt;DBH-&gt;prepare("INSERT INTO people (name) VALUES ('Yeaaap')");
        $STH-&gt;execute();
    }
}


Am I doing it in the right way?
Besides the already mentioned things I like to add a few of my own:

Connection charset
You should set the charset of the connection the be the same of your php files (and  definition when you use html):

Simply add , array(PDO::MYSQL_ATTR_INIT_COMMAND =&gt; "SET NAMES 'utf8'") after $this-&gt;pass

Coding Style

The naming of class variables shouldn't be all uppercase, so rename $DBH to $dbh.

Additionally I'd advice you the read the Coding Style Guide from the PHP Framework Interop Group which many php framework developers pay attention to lately.
http://www.php-fig.org/psr/psr-2/

There it says in Chapter 4.3 that you should put the opening curly brace of function on a new line.

User Input

As soon as some user input gets into your sql statement you should use parameterized queries, for example:

$stmt = $this-&gt;dbh-&gt;prepare("SELECT * FROM user WHERE passwort_hash = :passwort_hash");

$stmt-&gt;bindParam(":passwort_hash",md5($_POST['passwort']));
$stmt-&gt;execute();
...


This protects you against SQL-Injections.