title: Should I still escape my data when inserting to custom table?
body: <p>I found a <a href="https://stackoverflow.com/questions/3143614/do-php-pdo-prepared-statments-need-to-be-escaped">similar question</a>, but it didn't really give me the answer I was looking for. <a href="http://wp.tutsplus.com/tutorials/creative-coding/data-sanitization-and-validation-with-wordpress/" rel="nofollow noreferrer">This tutorial</a> explains the most important sanitation functions WordPress uses.</p>
  
  <p>I'm using PDO to store form data into custom tables. A lot of this data contains names like <code>l'this</code> and <code>Cotélac &amp; Blancé</code>.</p>
  
  <p>If I put aside e-mail and url fields, is it enough to use <code>esc_attr</code> and <code>esc_html</code> to avid SQL injection and cross site scripting? </p>
  
  <p>Should I use this before data is saved to DB? Or just before I out put it to screen?</p>
  
  <pre><code>//From Wordpress
  esc_html -&gt; Escaping for HTML blocks
  esc_attr -&gt; Encodes the &lt;, &gt;, &amp;, " and '
  </code></pre>
  
  <p>This is a typical query I use: </p>
  
  <pre><code>$sql = " SELECT name
           FROM name
           WHERE user_name = :user_name
           AND fk_ID = :some_id ";
  
  $stmt = $this-&gt;db-&gt;prepare($sql);
  $stmt-&gt;bindParam(':user_name', $name, PDO::PARAM_STR);
  $stmt-&gt;bindParam(':some_id', $some_id, PDO::PARAM_STR);
  $stmt-&gt;execute();
  
  $result = $stmt-&gt;fetchAll();
  return $result;
  
  // alternative (from another query)
  $stmt = $this-&gt;db-&gt;prepare($sql);
  $stmt-&gt;execute(array(':id'=&gt; $id));
  $result = $stmt-&gt;fetchAll(PDO::FETCH_ASSOC);
  
  return $result;
  </code></pre>