title: PDO vs MYSQLI, Prepared Statemens and Binding Parameters
body: <p>I have this very question to clear things up. I read some documentation and comments around but still somethings are just not clear enough.</p>
  
  <ul>
  <li>I understand PDO offers more drivers which would certainly is a plus if you would ever change your database type.</li>
  <li>As said on another post, PDO doesnt offer true prepared statements but mysqli does so it would be safer to use MYSQLI</li>
  <li>Benchmarks looks similar, (did not test it myself but checked around on the web for a few benchmarks)</li>
  <li>Being object oriented is not an issue for me since mysqli is catching up. But would be nice to benchmark procedural mysqli vs PDO since procedural is supposed to be slightly faster.</li>
  </ul>
  
  <p>But here is my question, with prepared statement, do we have to use parameter binding with the data we use in our statement? good practice or have to? I understand prepared statements are good perfermance-wise if you run the same query multiple times but it is enough to secure the query itself? or binding parameters is a must? What exactly do the binding parameters and how it works to protect the data from sql injection? Also would be appreciated if you point our any misunderstanding about the statements I made above.</p>