title: using placeholders with php and mysql to prevent injection
body: <p>I understand <code>mysql_</code> has been deprecated, but I'm just using it as a tool to learn from a book.</p>
  
  <p>I'm trying to learn about placeholders and I got the following error when I clicked on "add record":</p>
  
  <pre><code>INSERT failed: EXECUTE statement USING @first,@last,@email,@user 
  Unknown prepared statement handler (statement) given to EXECUTE
  </code></pre>
  
  <p>using the following code:</p>
  
  <pre><code>if (isset($_POST['first']) &amp;&amp; isset($_POST['last']) &amp;&amp; isset($_POST['user_name']) &amp;&amp; isset($_POST['email']))
  {
      $first      = get_post('first');
      $last       = get_post('last');
      $email      = get_post('email');
      $user_name      = get_post('user_name');
  
      // begin placeholde code
      $query = 'PREPARE statement FROM "INSERT INTO user_master VALUES(?,?,?,?)"';
      mysql_query($query);
  
      $query = 'SET @first = "$first",' . 'SET @last = "$last",' . 'SET @email = "$email",' . 'SET @user_name = "$user_name",';
      mysql_query($query);
  
      $query = 'EXECUTE statement USING @first,@last,@email,@user';
      mysql_query;
  
      // end placeholder code
  
      if(!mysql_query($query, $db_server)) echo "INSERT failed: $query &lt;br /&gt;" . mysql_error() . "&lt;br /&gt;&lt;br /&gt;";
  }
  
  
  echo &lt;&lt;&lt;END
  &lt;form action = "willingLog.html" method="post"&gt;&lt;fieldset&gt;&lt;legend&gt;Sign Up:&lt;/legend&gt;    &lt;pre&gt;
      First       &lt;input type="text" name="first" /&gt;
      Last        &lt;input type="text" name="last" /&gt;
      Email       &lt;input type="text" name="email" /&gt;
      Username    &lt;input type="text" name="user_name" /&gt;
                  &lt;input type="submit" value="AD RECORD" /&gt;
  &lt;/pre&gt;&lt;/fieldset&gt;&lt;/form&gt;
  END;
  
  // also from placeholder code
  $query = 'DEALLOCATE PREPARE statement';
  mysql_query($query);
  // end placeholder code
  </code></pre>