Inserting users using PDO prepared statements I made a small script to update fields in a database. I'm using PDO to connect to MySQL. All the business logic of PHP is in the top half of the file, and the form is at the bottom.

Here is the full code. If it's a POST request, it opens the PDO connection and inserts the values from the form.

&lt;?php

/**
 * Use an HTML form to update the users table 
 * with new entries.
 *
 */

if ($_POST) 
{

    require_once "config.php";
    require_once "common.php";

    try 
    {
        $connection = new PDO($dsn, $username, $password, $options);

        $sql = "INSERT INTO users (firstname, lastname, email, age, location)
                VALUES (:firstname, :lastname, :email, :age, :location)";

        $statement = $connection-&gt;prepare($sql);

        $statement-&gt;execute(array(
            "firstname" =&gt; $_POST['firstname'],
            "lastname"  =&gt; $_POST['lastname'],
            "email"     =&gt; $_POST['email'],
            "age"       =&gt; $_POST['age'],
            "location"  =&gt; $_POST['location']
        ));

    }

    catch(PDOException $error) 
    {
        echo $sql . "&lt;br&gt;" . $error-&gt;getMessage();
    }
}
?&gt;
&lt;!doctype html&gt;
&lt;html lang="en"&gt;

&lt;head&gt;
    &lt;meta charset="utf-8"&gt;
    &lt;meta http-equiv="x-ua-compatible" content="ie=edge"&gt;
    &lt;meta name="viewport" content="width=device-width, initial-scale=1"&gt;

    &lt;link rel="stylesheet" href="css/primitive.css"&gt;
    &lt;title&gt;Update Users&lt;/title&gt;

&lt;/head&gt;

&lt;body&gt;

    &lt;div class="small-container"&gt;
        &lt;h1&gt;Add a user&lt;/h1&gt;

            &lt;form method="post"&gt;
                &lt;label for="firstname"&gt;First Name&lt;/label&gt;
                &lt;input type="text" name="firstname" id="firstname"&gt;
                &lt;label for="lastname"&gt;Last Name&lt;/label&gt;
                &lt;input type="text" name="lastname" id="lastname"&gt;
                &lt;label for="email"&gt;Email Address&lt;/label&gt;
                &lt;input type="text" name="email" id="email"&gt;
                &lt;label for="age"&gt;Age&lt;/label&gt;
                &lt;input type="text" name="age" id="age"&gt;
                &lt;label for="location"&gt;Location&lt;/label&gt;
                &lt;input type="text" name="location" id="location"&gt;
                &lt;input type="submit" value="Submit"&gt;
            &lt;/form&gt;
    &lt;/div&gt;

&lt;/body&gt;

&lt;/html&gt;


I know I can sanitize HTML input by doing something like:

function escape($html)
{
    return htmlspecialchars($html, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
}

// example use
escape($_POST['firstname']);


I'm wondering how necessary it is when I'm using a prepared statement. I'm still a bit confused about sanitization and filtering, and when it's necessary. I know it's necessary when printing data out to HTML, but not sure how much when receiving input to PDO.

Please forgive any and all ignorance. I'm writing this from scratch and doing my best to teach myself PHP without frameworks.
Do not escape SQL query parameters when using PDO. PDO will do the right thing. If you call unnecessary escaping functions "just in case", then you end up mangling the data. That's how you get junk like "this &amp;amp; that" appearing in some broken web pages.

When would you want to escape text using htmlspecialchars()? When outputting text to be embedded in HTML. For example,

 &lt;input type="text" name="firstname" id="firstname" value="&lt;?php echo escape($_POST['firstname']); ?&gt;"&gt;


If you didn't call htmlspecialchars() on $_POST['firstname'], then a malicious user could break the page by inputting a name that contained double-quotes.