title: PDO : Need to escape string or not ?
body: <p>I use this code to insert some data into my database.
  I adapt my previous code based on mysqli to use PDO now.</p>
  
  <p><strong>For the 2 parameters name and id, do i need to escape them using a function like mysqli_real_escape_string with PDO ?</strong> or is it OK to pass these params direclty in the query ?</p>
  
  <pre><code>&lt;?php
  try
  {  
      $pdo = new   PDO('mysql:host='.$servername.';port='.$dbport.';dbname='.$dbname.'', $username, $decodedPwd);
  
      $pdo-&gt;setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
      $pdo-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  
      $json = $_POST['jsonData'];
      $id = $json["id"]
      $name = $json["name"]
  
      $pdo-&gt;beginTransaction();
  
      // do request
  
      $pdo-&gt;query('INSERT INTO test(id, name) VALUES ('$id', '$name')');
  
      $pdo-&gt;commit();
  
      echo 'Everything is OK';
  }
  catch(Exception $e)
  {
      $pdo-&gt;rollback();
  
      echo 'An error occurred :&lt;br /&gt;';
      echo 'Error : '.$e-&gt;getMessage().'&lt;br /&gt;';
      echo 'N° : '.$e-&gt;getCode();
  
      exit();
  }
  </code></pre>