title: How to use/write mysql_real_escape_string in PDO?
body: <p>In my code Im trying to translate mysql_real_escape_string into a PDO statement. Does somebody have a tip on how to write mysql_real_escape_string in PDO?</p>
  
  <p>Im using mysql_real_escape_string in two lines:
  $userName = mysql_real_escape_string($_POST['username']);
  $password = sha1(mysql_real_escape_string($_POST['password']));</p>
  
  <pre><code>&lt;?php
  ob_start();
  session_start();
  include("../database/db.php");
  
  $userName = mysql_real_escape_string($_POST['username']);
  $password = sha1(mysql_real_escape_string($_POST['password']));
  echo "&lt;br&gt;user: " . $userName;
  echo "&lt;br&gt; pw: " . $password;
  
  $query = "select * from tbladmin where admin_usr_name='$userName' and admin_pwd='$password'";
  
  $res = mysql_query($query);
  
  // $rows = $res-&gt;fetch(PDO::FETCH_ASSOC); 
  $rows = mysql_fetch_assoc($res);
  echo "&lt;br&gt;numrows" . mysql_num_rows($res) . "&lt;br&gt;";
  
  // $find = $query-&gt;prepare("select * from tbladmin where admin_usr_name='$userName' and admin_pwd='$password'");
  // $find-&gt;execute();
  // if ($find-&gt;fetchColumn() &gt; 0)
  // {
  // echo 'You made it, welcome';
  //  $_SESSION['userName']  =  $rows['admin_usr_name'];
  //  $_SESSION['admin_id'] = $rows['admin_id'];
  //  header("location: ../pages/content.php");
  // }
  // else
  // {
  //  echo 'Username and password dont match &lt;br/&gt; Try again';
  //  header("location: ../index.php?loginerror=yes");
  // } 
  
  if(mysql_num_rows($res)&gt;0)
  {
      $_SESSION['userName']  =  $rows['admin_usr_name'];
      $_SESSION['admin_id'] = $rows['admin_id'];
      header("location: ../pages/content.php");
  }
  else
  {
      echo 'Username and password dont match &lt;br/&gt; Try again';
      header("location: ../index.php?loginerror=yes");
  } 
  </code></pre>
  
  <p>?></p>
  
  <p>This is what Im trying to do with PDO</p>
  
  <pre><code>  $host = "localhost"; 
  $user = "root"; 
  $password = "root";
  $db = "blog";
  
  $dsn = "mysql:host=$host;dbname=$db;charset=utf8";
  $opt = array(PDO::ATTR_ERRMODE =&gt; PDO::ERRMODE_EXCEPTION,PDO::ATTR_DEFAULT_FETCH_MODE =&gt; PDO::FETCH_ASSOC);
  $pdo = new PDO($dsn,$user,$password, $opt);
  
  $username = $_POST['username'];
  $password = $_POST['password'];
  $query = "select * from tbladmin where admin_usr_name=:userName and admin_pwd=:passWord";
  
  try 
  {   
  $databas = new PDO($dsn, $user, $password);
  } 
  catch (PDOException $e) 
  {
  echo 'Connection failed: ' . $e-&gt;getMessage();
  }
  
  $statement = $databas-&gt;prepare($query);
  
  $statement-&gt;execute(array(':userName'=&gt;$username, ':passWord'=&gt; $password)); 
  $row = $statement-&gt;fetch();
  </code></pre>
  
  <p>I always get this error:
  Call to a member function prepare() on a non-object </p>