title: MySQL PHP PDO prepared statements - performance issues vs security
body: <p>I am thinking of rewriting some open-source application for my purposes to PDO and transactions using InnoDB (mysql_query and MyISAM now).</p>
  
  <p>My question is: Which cases are reasonable for using prepared statements?</p>
  
  <p>Because everywhere I am reading is stated (even in many posts here) that I should use prepared statements every time and everywhere because of the 1. security and 2. performance. Even PHP manual recommends using prepared statements and not mentioning the escape-thing.</p>
  
  <p>You can't deny the security mechanism. But thinking it over and over it comes to mind that having to prepare the statement every time and then use it once.. It doesn't make sense. While having to insert 1000 times some variables in single statement, that makes sense but it is obvious. But this is not what common eshop or board is built upon.</p>
  
  <p>So how to overcome this? May I prepare my statements application-wide and to name them specifically? Can I prepare several different statements and to use them by name? Because this is the only reasonable solution I am thinking of (except the 1000x thing).</p>
  
  <p>I found there is this mysql_real_escape called $pdo->quote as well for the purpose of single query. Why not to use this? Why to bother with preparing?</p>
  
  <p>And what do you think of this excellent article?
  <a href="http://blog.ulf-wendel.de/2008/pdo_mysqlnd-prepared-statements-again/" rel="noreferrer">http://blog.ulf-wendel.de/2008/pdo_mysqlnd-prepared-statements-again/</a></p>
  
  <p>Do you agree with the overhead caused by preparing the statements?</p>
  
  <p>Thanks</p>