title: PDO Query - Is this safe from SQL Injection?
body: <p>I've been reading and asked a question about SQL Injection safe queries and everyone is saying that I should use PDO, so I just enabled my MYSQL PDO extension and made a simple query.</p>
  
  <p>So this is my code:</p>
  
  <pre><code>public static function Add($catName, $catDescr = "", $catImgURL = "", $catSubLevel = 0, $catSubID = 0)
  {
  
      try
      {
          include_once "db_config.php";
          $DBH = new PDO("mysql:host=$db_host;dbname=$db_name", $db_user, $db_pass);
          $DBH-&gt;setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING );  
          $STH = $DBH-&gt;prepare("INSERT INTO cat (catName, catDescr, catImg, catSubLevel, catSubID)
                                VALUES ('$catName', '$catDescr', '$catImgURL', $catSubLevel, $catSubID)");
  
          $STH-&gt;execute();
      }
      catch (PDOException $e)
      {
          echo $e-&gt;getMessage();
      }
  }
  </code></pre>
  
  <p>So everything works and seems safe, but when I do something like this:</p>
  
  <pre><code>Cat::Add("Test Cat", "' OR 1==1 --");
  </code></pre>
  
  <p>It gives me </p>
  
  <blockquote>
    <p>Warning: PDOStatement::execute()
    [pdostatement.execute]:
    SQLSTATE[42000]: Syntax error or
    access violation: 1064 You have an
    error in your SQL syntax; check the
    manual that corresponds to your MySQL
    server version for the right syntax to
    use near '==1 --', '', 0, 0)' at line
    2 in www\mCat.php on line
    25</p>
  </blockquote>
  
  <p>I suppose it is because I added <code>$DBH-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING);</code> in order to see when I have errors.</p>
  
  <p>Anyway the main question is - <strong>is this method safe from SQL injection?</strong></p>