title: When to use PDO prepared queries. mysql_real_escape error
body: <p>I'm been making a php site, developing on my local machine. Really new to this so this is the first thing i've ever attempted. When I moved to my host, i get the following error:</p>
  
  <pre><code> Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied             for user 'matthew'@'localhost' (using password: NO)  on line 11
  </code></pre>
  
  <p>I've searched on here a fair bit and I'm pretty sure its because i need to 'prepare' my queries. What I am unsure of is when is it correct to prepare, and when not. I've added some of my queries below to explain in detail: </p>
  
  <p>connection to db:</p>
  
  <pre><code>$hostname = "localhost";
  $username = "root";
  $password = "root";
  
  try {
      $dbh = new PDO("mysql:host=$hostname;dbname=wmpt", $username, $password);
  //echo "Connected to database"; // check for connection
      }
  catch(PDOException $e)
      {
      echo $e-&gt;getMessage();
      }
  </code></pre>
  
  <p>Here is an example query:</p>
  
  <pre><code>$username = mysql_real_escape_string($_POST['run']);
  
  
  $STH = $dbh-&gt;query("SELECT * FROM tblusers WHERE username = '$username' ");
  $STH-&gt;setFetchMode(PDO::FETCH_ASSOC);  
  $result = $STH-&gt;fetch();
  </code></pre>
  
  <p>My question is, do I only need to "prepare" a query if I am querying/inserting/updating the DB with user submitted data?</p>
  
  <p>Is the above query bad practice? What if it didnt contain user submitted data, ie i wanted to query </p>
  
  <pre><code> $STH = $dbh-&gt;query("SELECT * FROM tblusers WHERE username LIKE '%hotmail%' ");
  </code></pre>
  
  <p>That probably a bad example, but I'm illustrating a developer defined query.</p>
  
  <p>Is this the reason I get, and how i can avoid:</p>
  
  <pre><code>Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for     user 'matthew'@'localhost' (using password: NO)  on line 11
  </code></pre>