title: PDO MySQL: Use PDO::ATTR_EMULATE_PREPARES or not?
body: <p>This is what I've read so far about <a href="http://www.php.net/manual/en/pdo.setattribute.php" rel="noreferrer"><code>PDO::ATTR_EMULATE_PREPARES</code></a>:</p>
  
  <ol>
  <li><a href="https://stackoverflow.com/a/5751895">PDO's prepare emulation is better for performance since MySQL's native prepare bypasses the query cache</a>.</li>
  <li><a href="https://stackoverflow.com/a/1314549">MySQL's native prepare is better for security (preventing SQL Injection)</a>.</li>
  <li><a href="https://stackoverflow.com/questions/3727186/the-way-pdo-parametrized-query-works">MySQL's native prepare is better for error reporting</a>.</li>
  </ol>
  
  <p>I don't know how true any of these statements are anymore. My greatest concern in choosing a MySQL interface is preventing SQL Injection. The second concern is performance.</p>
  
  <p>My application currently uses procedural MySQLi (without prepared statements), and utilizes the query cache quite a bit. It will rarely re-use prepared statements in a single request. I started the move to PDO for the named parameters and security of prepared statements.</p>
  
  <p>I'm using <code>MySQL 5.1.61</code> and <code>PHP 5.3.2</code></p>
  
  <p>Should I leave <code>PDO::ATTR_EMULATE_PREPARES</code> enabled or not? Is there a way to have both the performance of the query cache and the security of prepared statements?</p>