title: PHP bind_param using variables or POST?
body: <p>When using bind_param with a mysqli prepared statement, I am unsure whether to use <code>$_POST</code> or variables. If the <code>bind_param</code> values come from a form submitted through a website, is it unsafe to put the <code>$_POST</code> values straight into the <code>bind_param</code>?</p>
  
  <pre><code>$newBlog-&gt;bind_param('ss',$_POST['newBlogTitle'],$_POST['newBlogContent']);
  </code></pre>
  
  <p>or </p>
  
  <pre><code>$newBlogTitle = $_POST['newBlogTitle'];
  $newBlogTitle = $_POST['newBlogContent'];
  $newBlog-&gt;bind_param('ss',$newBlogTitle,$newBlogContent);
  </code></pre>
  
  <p>Or does it not matter?</p>