title: PDO Update query secure?
body: <p>Im trying to understand and read up on PDO. </p>
  
  <p>I've just written the following and it works fine, but I'm wondering if its secure as I dont escape any variables, is it still a requirement I escape these?</p>
  
  <pre><code>// Get Post Variables 
  $first_name = $_POST['first_name'];
  $surname = $_POST['surname'];
  $email_addr = $_POST['email_addr'];
  $user_type = $_POST['user_type'];
  
  
  // query
  $sql = "UPDATE users
      SET first_name=?, surname=?, email_addr=?, user_age=?, user_type=?
      WHERE user_id=?";
  $q = $conn-&gt;prepare($sql);
  $q-&gt;execute(array($first_name,$surname,$email_addr,$user_age,$user_type,$uid));
  </code></pre>