title: Do i need to sanitize input if using prepared PHP/MySQL queries?
body: <p>Given the following piece of code, Do i need to escape and sanitize <code>$city</code>?</p>
  
  <pre><code>&lt;?php
  $mysqli = new mysqli("localhost", "my_user", "my_password", "world");
  
  /* check connection */
  if (mysqli_connect_errno()) {
      printf("Connect failed: %s\n", mysqli_connect_error());
      exit();
  }
  
  $city = "Amersfoort";
  
  /* create a prepared statement */
  if ($stmt = $mysqli-&gt;prepare("SELECT District FROM City WHERE Name=?")) {
  
      /* bind parameters for markers */
      $stmt-&gt;bind_param("s", $city);
  
      /* execute query */
      $stmt-&gt;execute();
  
      /* bind result variables */
      $stmt-&gt;bind_result($district);
  
      /* fetch value */
      $stmt-&gt;fetch();
  
      printf("%s is in district %s\n", $city, $district);
  
      /* close statement */
      $stmt-&gt;close();
  }
  
  /* close connection */
  $mysqli-&gt;close();
  ?&gt;
  </code></pre>
  
  <p>Do you need to sanitize any input when using prepared queries?</p>