title: Single Quote Escape in PDO Prepared Statement Parameters
body: <p>So I understand PDO Prepared Statements should protect from SQL injection and ' escapes. But when I attempted the following...</p>
  
  <pre><code>if ($_SERVER["REQUEST_METHOD"] == "POST" &amp;&amp; isset($_POST["id"]))
  {   
      $id = $_POST["id"]; 
      //$id = "2' AND name='Entry2";
      $someinfo = "updated";
  
      ...DB Stuff...
  
      $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $dbpassword);
  
      $stmt = $conn-&gt;prepare("UPDATE testdb SET info=:someinfo WHERE id=:id");
  
      $stmt-&gt;bindParam(':id', $id);
      $stmt-&gt;bindParam(':someinfo', $someinfo);
      $stmt-&gt;execute();
  
      $conn = null;
  
      exit();
  }
  </code></pre>
  
  <p>Then the row with id=2 and name=entry2 would be updated. Now it doesn't seem like this can be used to escape into other SQL queries, and I assume I can take precautions to ensure this kind of escape can't really do damage. But I wanted to be sure that there wasn't some other way to prevent ' escapes making unexpected changes to SQL query parameters. (Worth noting, I tried something similar in SQLi and got pretty much the same result.)</p>
  
  <p>Is there something I'm missing? Or is this just the way Prepared Statements work.</p>