title: When should I use prepared statements?
body: <p>Originally I used <code>mysql_connect</code> and <code>mysql_query</code> to do things. Then I learned of SQL injection, so I am trying to learn how to use prepared statements. I understand how the prepare and execute functions of the PDO class are useful to prevent SQL injection.</p>
  
  <p>Are prepared statements only necessary when a users input is stored into a database? Would it be okay to still use <code>mysql_num_rows</code>, since I don't really run the risk of being hacked into by using this function? Or is it more secure to use prepared statements to do this? Should I use prepared statements for everything that involves using MySQL? Why?</p>