title: How to avoid mysql injections using PDO
body: <p>How can I avoid mysql injections? This is the PHP file I have right now</p>
  
  <pre><code>&lt;?php
  include 'config.php';
  
  $Name = $_GET['Name'] ;
  
  $sql = "Select * from tables where names =\"$Name\"";
  
  
  
  try {
      $dbh = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
      $dbh-&gt;query('SET CHARACTER SET utf8');
      $dbh-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
      $stmt = $dbh-&gt;query($sql);  
      $names = $stmt-&gt;fetchAll(PDO::FETCH_OBJ);
      $dbh = null;
      echo '{"key":'. json_encode($names) .'}'; 
  } catch(PDOException $e) {
      echo '{"error":{"text":'. $e-&gt;getMessage() .'}}'; 
  }
  
  
  ?&gt;
  </code></pre>
  
  <p>When I put <code>$stmt = $dbh-&gt;query($sql); $stmt-&gt;execute(array(':name' =&gt; $name));</code> to the code it doesn't work. So how should I do it?</p>