title: Should we always bind our SQL statements?
body: <p>I have been researching into PDO's <code>bindValue()</code>. I know that preparing my SQL statements with PDO is keeping SQL injections from happening.</p>
  
  <p><strong>Code Example:</strong></p>
  
  <pre><code>$stmt = $dbh-&gt;prepare('SELECT * FROM articles WHERE id = :id AND title = :title');
  $stmt-&gt;bindValue(':id', PDO::PARAM_INT);
  $stmt-&gt;bindValue(':title', PDO::PARAM_STR);
  $stmt-&gt;execute();
  </code></pre>
  
  <p>By binding the ID as a number, and the Title was a string, we can limit the damage done when someone tries to do an SQL injection within the code.</p>
  
  <p>Should we always bind our values with a <code>PDO::PARAM_</code> so we can limit what can be pulled from the database in an SQL injection? Does this add more security with PDO when doing our <code>bindValue()</code>?</p>