PHP MySQL PDO sql injection safety

gistfile1.txt

$pdo = new PDO('mysql:dbname=your_database;host=localhost', $username, $password);
//don't use whatever the user typed in, use a variable
$stmt = $pdo->prepare('SELECT * FROM MyGuestBook WHERE firstName = :firstName');
//that variable is then assigned to whatever the user typed in, but it's escaped and treated safely
$stmt->execute(array(':firstName' => $firstName));