title: How to safely insert data to mysql using php pdo
body: <p>I have this php pdo:</p>
  
  <pre><code>try {        
                  $STH = $db-&gt;prepare("INSERT INTO racuni (napomene) VALUES (:12)");
  
                  $STH-&gt;bindParam(':12', $_POST['napomena'], PDO::PARAM_STR);
  
  
  
              } catch (PDOException $e) {
                  echo $e-&gt;getMessage();
              }
  </code></pre>
  
  <p>and now when I try to add this data to mysql:</p>
  
  <pre><code>&lt;script&gt;alert('heheheheheheh')&lt;/script&gt;
  </code></pre>
  
  <p>there is no string escapes? And in database I have the same data:<code>&lt;script&gt;alert('heheheheheheh')&lt;/script&gt;</code></p>
  
  <p>SO,</p>
  
  <p>What is the best, safe way to insert data to mysql using php pdo?</p>