title: SQL Injection PHP: Do I need to validate the user input using parameterized queries?
body: <p>For example, i have this input:</p>
  
  <p><strong>Name</strong>: <em>Wally</em></p>
  
  <p><strong>Email</strong>: <em>wallycat@example.com'; DROP TABLE ClientTable; PRINT 'Too bad!'--</em></p>
  
  <p>My parameterized query is:</p>
  
  <pre><code>$name = $_REQUEST['name'];
  
  $email = $_REQUEST['email'];
  
  $sql = "INSERT INTO ClientTable (Name, Email)
  
          VALUES ('$name', '$email')";
  </code></pre>
  
  <p>Even if I use this parameterized query, do I need to validate the user input? (in this case, the email field)</p>
  
  <p>Or, is already safe since i'm using a parameterized query, and the query will simple store all this: 'wallycat@example.com'; DROP TABLE ClientTable; PRINT 'Too bad!'--' in the database?</p>
  
  <p>Thank you!</p>