title: Is it really nesseccary to PREPARE statements with PHP's mysqli?
body: <p>At the moment I have some database wrapper functions like so:</p>
  
  <pre><code>function db_escape($str) {
      return mysql_real_escape_string($str);
  }
  
  function db_query($sql) {
      global $LINKID;
      return mysql_query ($sql, $LINKID);
  }
  
  function db_fetch_array($result) {
      return mysql_fetch_array ($result, MYSQL_ASSOC);
  }
  </code></pre>
  
  <p>In my code I can then do things like:</p>
  
  <pre><code>$result = db_query('SELECT userid, first_name, last_name FROM user 
                      WHERE email = "' . db_escape($email) . '"');
  
  if ($result) {
      $user = db_fetch_array($result);
  }
  </code></pre>
  
  <p>One of the ideas behind this is that when I switch from mysql to mysqli, it'll take just a few minutes to update my wrapper functions and I don't have to replace hundreds of instances of <code>mysql_real_escape_string()</code>, <code>mysql_query()</code> and <code>mysql_fetch_array()</code> across hundreds of different projects.</p>
  
  <p>The only issue with this is that the above can translate to standard procedural mysqli functions easily enough, but not prepared statements.</p>
  
  <p>Does this matter?  It seems like every tutorial says prepared statements are important for security and performance, however at the moment:</p>
  
  <ol>
  <li>None of my projects have performance issues.</li>
  <li>I am extremely anal about casting user input to the expected type (string, integer, float, etc.) and also manually escaping any user input that's used anywhere in a query.</li>
  </ol>
  
  <p>With this in mind is it really necessary to switch to prepared statements, for either past or future projects?</p>