title: What application inserts html comment tags around PHP tags in SQL query?
body: <p>I'm using PDO and prepared statements to insert entries into a MySQL database.  Works great so far.  I realize that my question is basically rendered moot if the input is also sanitized with a function like <code>htmlentities()</code>, but as a matter of curiosity, does php code that's been injected into a database ever get executed on the way back out?</p>
  
  <p>For example:</p>
  
  <pre><code>    $connection = new PDO(//some database info);
      $query = $connection-&gt;prepare("INSERT INTO House (Rooms) VALUES (:newroom);");
      $query-&gt;bindValue(':newroom', $_POST['newroom'], PDO::PARAM_STR);
      $query-&gt;execute();
  </code></pre>
  
  <p>Now let's say a user enters the value for $_POST['newroom'] as:</p>
  
  <pre><code>    &lt;?php var_dump($connection); ?&gt;
  </code></pre>
  
  <p>This goes into the database as-is, because although PDO prevents execution of SQL code, it doesn't necessarily escape PHP tags (or does it?  This is basically my question.)</p>
  
  <p>Now let's say the user visits another page that executes this query:</p>
  
  <pre><code>    $connection = new PDO(//some database info);
      $query = $connection-&gt;prepare("SELECT * FROM Rooms;");
      $query-&gt;execute();
  </code></pre>
  
  <p>And then it loops over the results, echoing them as options in a select input in an html form like this:</p>
  
  <pre><code>    &lt;select&gt;
      &lt;option value = 1&gt;Kitchen&lt;/option&gt;
      &lt;option value = 2&gt;Bathroom&lt;/option&gt;
      &lt;option value = 3&gt;&lt;?php var_dump($connection); ?&gt;&lt;/option&gt;
      &lt;/select&gt;
  </code></pre>
  
  <p>I've tried doing this, and the php tags in the database echo out with HTML comment tags, resulting in a blank entry in the select input, like this:</p>
  
  <pre><code>    &lt;option value = 3&gt;&lt;!--?php var_dump($connection) ?--&gt;&lt;/option&gt;
  </code></pre>
  
  <p>Obviously, the php was not executed.  That's great, but I'm curious what decided to escape the tags.  MySQL?  PHP itself?  Can I always count on this behavior, i.e. that php code returned from a database will parse as an html comment?</p>