PDO prepared statement to insert data into MySQL I am changing all mysqli queries to use PDO now and just want to make sure I'm doing it right.  Here is an old one:

$sql = "INSERT into profile (profileid, name, description) values ('$profileid', '$name', '$description')";
        $sql= mysqli_query($connection,$sql);
        if (!$sql) {
        die("Database query failed: " . mysqli_error($connection));
        } else {
        redirect_to('/my-account'); 
        }


And here is how I rewrote it:

$stmt = $pdo-&gt;prepare("INSERT into pools (profileid, name, description) values (:profileid, :name, :description)");

$stmt-&gt;execute([':profileid' =&gt; $profileid, ':name' =&gt; $name, ':poolname' =&gt; $poolname, ':description' =&gt; $description]);

redirect_to('/my-pools');


It seemed to work fine when I tested, just want to make sure I did EVERYTHING right.  Does it all look good?

Also, prior to my old mysqli query, I would do this to "sanitize" the data:

$description = mysqli_real_escape_string($connection,$_POST['description']);


With PDO, I do NOT have to have that AT ALL anymore, is that correct?  Just want to confirm before I delete all the escaping stuff from my code after switching to PDO.
Yes, you did everything right, save for the obvious typo with the extra parameter. You can keep with it all right. 

The only improvement (which is the point of this site) I can think of is that you can make this code less bloated, with help of positional placeholders.

$sql = "INSERT into pools (profileid, name, description) values (?,?,?)";
$pdo-&gt;prepare($sql)-&gt;execute([$profileid, $name, $description]);
redirect_to('/my-pools');


To my taste, this is the most clear and readable approach: now it fits onto screen without horizontal scrolling and you still can visually control the parameter order.