title: mysql_real_escape_string with PDO PHP
body: <p>Hello i am new to PDO so getting confused and getting errors ;) with mysql_real_escape_string ..</p>
  
  <p>can any one help, here is my code </p>
  
  <pre><code>if(!empty($_POST) &amp;&amp; isset($_POST)) { 
  
  include ('connection_pdo.php');
  
  $dbh = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);
  
  $source_url= mysql_real_escape_string($_POST['source_url']);
  $class     = mysql_real_escape_string($_POST['class']);
  $year      = mysql_real_escape_string($_POST['year']);
  $date      = time();
  $ip        = $_SERVER['REMOTE_ADDR'];
  
  $insert = $dbh-&gt;prepare("
    INSERT IGNORE INTO school_students_images
              ( folder_name,  image_url,  source_url,  class, year , date , ip )
      VALUES  (:folder_name, :image_url, :source_url, :class, :year, :date, :ip)
  ");
  
  $a=0;
  while ($a&lt;1000){
  $a++;
  $insert-&gt;execute(array(
              'folder_name'=&gt; $name-&gt;content, //** geting from other source
              'image_url'  =&gt; $link[$a], //** geting from other source
              'source_url' =&gt; $source_url,
              'class'      =&gt; $class ,
              'year'       =&gt; $year ,
              'date'       =&gt; $date,
              'ip'         =&gt; $ip
              ));
  }
  </code></pre>
  
  <p>it not working getting error but if i am using it with-out </p>
  
  <pre><code>    $source_url= ($_POST['source_url']);
      $class     = ($_POST['class']);
      $year      = ($_POST['year']);
      $date      = time();
      $ip        = $_SERVER['REMOTE_ADDR'];
  </code></pre>
  
  <p>it is working ... so i am confused is it safe to POST without mysql_real_escape_string into database? (is PDO giving any security by default ?) or i am doing some mistake in this...
  please help</p>