This is a security question.I'm quite new to PHP and just a beginner in SQLite.For practical, and educational reasons, I'm writing a small PHP site that will serve as one-threaded discussion (meaning, only one topic / no topics) between me and my friends.The site will be open to the Internet and the final version will include authentication, but I haven't reached the point of authentication yet. I have, however, reached the point where I can write and read posts in a database, and I need your opinion on how secure my ways are.This is code taken, and simplified from my prototype. It demonstrates how I read and write things with SQLite. I've removed things such as paging (dividing into pages) and posting a message, along with the sane checks for those things (i.e.: posts have a limit of 10kB).You can see the code bellow, but in summary these are my security measures:I escape stringsI replace HTML special charactersI use PDOI use prepared statementsI make sure my queries/statements end with a ';'My questions are:I'm using a prepared statement to write data inside the db. Can, and should I use a prepared statement to read data from the db? If yes, then can you make an example?Are these measures enough to avoid SQL injections and XSS injections?What else do you see wrong in this code? What security holes does it have that I haven't found yet?Also, if you have a performance recommendation, that doesn't compromise security, then go right ahead :)<?php// script settingserror_reporting(E_ALL);ini_set('default_charset', 'UTF-8');date_default_timezone_set('Europe/Helsinki');// time$unixtime = time();$localtime_offset = date('Z');// our input$message = 'hello world';if (!isset($message)) die(Give me something to store.);$message = SQLite3::escapeString($message);$message = htmlspecialchars($message, ENT_XHTML);echo <html>\n<head>\n</head>\n<body>\n\n;try{  $db = new PDO('sqlite:stackoveflow.db') or die(Can't create database.);  $db->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);  $db->exec(CREATE TABLE IF NOT EXISTS Wall (Id INTEGER PRIMARY KEY, Message TEXT NOT NULL, Unixtime INTEGER NOT NULL, Localtime_offset INTEGER NOT NULL););  // write the data  $statement = INSERT INTO Wall (Message, Unixtime, Localtime_offset) VALUES (:Message,:Unixtime,:Localtime_offset);;    $query = $db->prepare($statement);  $query->bindValue(':Message', $message, SQLITE3_TEXT);  $query->bindValue(':Unixtime', $unixtime, SQLITE3_INTEGER);  $query->bindValue(':Localtime_offset', $localtime_offset, SQLITE3_INTEGER);  $query->execute() or die($db->errorInfo());  // read the data  $result = $db->query('SELECT * FROM Wall');  if (!$result) die(Can't execute database query.);  foreach($result as $row)  {    $localtime = date(Y-m-d H:i:s P, $row['Unixtime']);    print <h2>Post # . $row['Id'] . , on  . $localtime . </h2>\n;    print $row['Message'] . \n\n;  }  $db = NULL;}catch(PDOException $exception){  echo $exception->getMessage();}echo \n</body>\n</html>;?>Update 1 : 2013-04-15I've made some adjustments based on user88171's suggestions.        // script settingserror_reporting(E_ALL);ini_set('default_charset', 'UTF-8');date_default_timezone_set('Europe/Helsinki');// time$unixtime = time();$localtime_offset = date('Z');$date = date('Y-m-d H:i:s O');// our input$message = hello   . chr(27) . world , , , , , , , ,  \xEF\xBB\xBF;// function to end the script and write a log report for the adminfunction error($msg){    // write the message to the error log and send an email to the admin    echo <p>An internal error occured. The administrator has been notified.</p>;    exit(1);}echo <html>\n<head>\n</head>\n<body>\n\n;// show us the input before insirting into the db$hex = bin2hex($message);$hex = chunk_split($hex,2, );echo <p><b>Our input:</b> $message</p>\n\n;echo <p><b>Out input in hex:</b> $hex</p>\n\n;echo <hr>\n\n;if (!isset($message)) die(<p>You need to give me an input.</p>);$message = str_replace(\r, '', $message);$message = SQLite3::escapeString($message);$message = htmlspecialchars($message, ENT_XHTML);try{    $db = new PDO('sqlite:stackoveflow.db') or error(Can't open or create database.);    $db->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);    $db->exec(CREATE TABLE IF NOT EXISTS Wall (Id INTEGER PRIMARY KEY, Message TEXT NOT     NULL, Unixtime INTEGER NOT NULL, Localtime_offset INTEGER NOT NULL););    // write the data    $statement = INSERT INTO Wall (Message, Unixtime, Localtime_offset) VALUES     (:Message,:Unixtime,:Localtime_offset);;        $query = $db->prepare($statement);    $query->bindValue(':Message', $message, SQLITE3_TEXT);    $query->bindValue(':Unixtime', $unixtime, SQLITE3_INTEGER);    $query->bindValue(':Localtime_offset', $localtime_offset, SQLITE3_INTEGER);    $query->execute() or error($db->errorInfo());    // read the data    $result = $db->query('SELECT * FROM Wall');    if (!$result) error(Can't execute database query.);    foreach($result as $row)    {        $localtime = date(Y-m-d H:i:s P, $row['Unixtime']);        print <h2>Post # . $row['Id'] . , on  . $localtime . </h2>\n\n;        print \t<p> . $row['Message'] . </p>\n\n;    }    $db = NULL;}catch(PDOException $exception){    error($exception->getMessage());}echo </body>\n</html>;?>                        
how secure is this way of writing and reading with PHP and SQLite?
php;security;sqlite