title: How to create a secure mysql prepared statement in php?
body: <p>I am new to using prepared statements in mysql with php. I need some help creating a prepared statement to retrieve columns.</p>
  
  <p>I need to get information from different columns. Currently for a test file, I use the <strong>completely unsecure</strong> SQL statement: </p>
  
  <pre><code>$qry = "SELECT * FROM mytable where userid='{$_GET['userid']}' AND category='{$_GET['category']}'ORDER BY id DESC"
  $result = mysql_query($qry) or die(mysql_error()); 
  </code></pre>
  
  <p>Can someone help me create a <strong>secure</strong> mysql statement using input from url parameters (as above) that is prepared?</p>
  
  <p>BONUS: Prepared statements are suppose to increase speed as well. Will it increase overall speed if I only use a prepared statement three or four times on a page?</p>