title: PHP PDO Prevent SQL Injection for MS SQL Server
body: <p>I see so many different people saying to do different things.  Is what I have enough for preventing SQL Injection into an MS SQL database? (not My SQL)</p>
  <pre><code>  &lt;?php
  
      $id = $_POST['id']; 
  
      $pdo = new PDO(&quot;sqlsrv:Server=&quot; . $DB_HOST . &quot;,&quot; . $DB_PORT . &quot;;Database=&quot; . $DB_DATABASE . &quot; &quot;,$DB_USERNAME ,$DB_PASSWORD);
      $pdo-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  
      $sql = &quot;SELECT * FROM mytable WHERE mytable_id = :id&quot;;   
      $result = $pdo-&gt;prepare($sql);
      $result-&gt;execute(['id'=&gt;$id]);
  
    ?&gt;
  </code></pre>