---
title: "Why is PDO better for escaping MySQL queries/querystrings than mysql_real_escape_string?"  
description: "Why is PDO better for escaping MySQL queries/querystrings than mysql_real_escape_string?"  
author: "Anonymous User"  
published: 2013-04-17  
updated: 2013-04-17  
canonical: https://www.mindstick.com/forum/777/why-is-pdo-better-for-escaping-mysql-queries-querystrings-than-mysql_real_escape_string  
category: "php"  
tags: ["php"]  
reading_time: 2 minutes  

---

# Why is PDO better for escaping MySQL queries/querystrings than mysql_real_escape_string?

Hi Expert!\
I've been told that I'd be better using PDO for MySQL escaping, rather than mysql_real_escape_string.\
Maybe I'm having a brain-dead day (or it may be the fact I'm by no stretch of the [imagination](https://yourviews.mindstick.com/audio/1246/how-reading-shapes-a-writer-s-imagination) a natural programmer, and I'm still very much at the newbie stage when \
it comes to PHP), but having checked out the PHP manual and read the entry on PDO, I'm still no clearer as to what PDO actually is and why it's better than using \
mysql_real_escape_string. This may be because I've not really got to grips with the complexities of OOP yet (I'm assuming it's something to do with OOP), but other \
than the fact that [variables](https://www.mindstick.com/articles/715/php-variables) and [array values](https://www.mindstick.com/forum/159317/merge-json-array-values-across-multiple-rows-in-mysql) seem to have a colon infront of them, I'm still not sure what it actually is and how you use it (and why it's better \
than mysql_real_escape_string. (It also may have something to do with the fact that I don't really have a clear [understanding](https://www.mindstick.com/articles/12918/cat-5e-vs-cat-6a-understanding-the-major-differences) of what 'classes' are, so when I read \
"PDO class" I'm none the wiser really).\
Having read an article or two on the '[Developer](https://www.mindstick.com/articles/157260/variation-between-web-designer-and-web-developer) Zone' bit of the MySQL [website](https://www.mindstick.com/articles/13110/why-copywriting-is-crucial-for-new-website-build), I'm still no clearer. As I can't even figure out what it is at the moment, I think \
probably using it is a bit beyond me [right now](https://answers.mindstick.com/qa/36863/what-would-happen-if-gravity-became-5-percent-stronger-right-now), but I'm still interested in broadening my [education](https://www.mindstick.com/articles/126288/is-technology-really-developing-education-system-a-reality-check-13-points) and finding out how I could improve things.\
Could [anyone explain](https://www.mindstick.com/forum/34220/can-anyone-explain-me-about-off-page-activity) to me in 'plain English' what PDO is (or point me in the [direction](https://yourviews.mindstick.com/story/5034/10-animals-with-the-best-sense-of-direction) of something on the subject written in plain English), and how you'd go about \
using it?\
Advance thanks!

## Replies

### Reply by AVADHESH PATEL

Hi Ben!\
imagine you write something along the lines of:\
$query = 'SELECT * FROM table WHERE id = ' . mysql_real_escape_string($id);this will not save you from injections, because $id could be 1 OR 1=1 and you will get all the records from the table. you’d have to cast $id to the right datatype \
(int in that case)\
pdo has another advantage, and that is the interchangability of database backends.


---

Original Source: https://www.mindstick.com/forum/777/why-is-pdo-better-for-escaping-mysql-queries-querystrings-than-mysql_real_escape_string

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.