Using prepared statements with PDO. From the article: PDO for Elegant PHP Database Access, http://www.modernphpbook.com/articles/pdo-for-elegant-php-database-access - Fig 10

PDOPreparedStatements.php

<?php 

$conn = new PDO('mysql:host=localhost;dbname=someDb', $username, $password);
$stmt = $conn->prepare ('
    INSERT INTO user (firstname, surname) VALUES (:firstname, :surname)
');

$stmt -> bindParam(':firstname', 'John');
$stmt -> bindParam(':surname', 'Smith');

$stmt -> execute();