title: PHP-PDO: Is PDO safe only for Inputing to the Database not Outputting from DB?
body: <p>Using <code>PDO</code> you'd moslty come across lines like: </p>
  
  <pre><code>$dbh-&gt;prepare("INSERT INTO REGISTRY (name, value) VALUES (?, ?)");
  
  $dbh-&gt;prepare("SELECT * FROM REGISTRY where name = ?");
  
  $dbh-&gt;prepare("UPDATE table_name SET col1= ?");
  </code></pre>
  
  <p>These are famous to being great for <em>Storing</em> data in the <code>Db</code>, <em>Getting</em> Data from the DB, and <em>Updating</em> data in the Db.</p>
  
  <p>When learning <code>PDO</code>, it's strongly emphasized to NOT <strong>bother</strong> <code>Sanitizing</code> your <code>data</code>, <code>PDO</code> will do the <strong>Sanitization</strong>.... You can <strong><em>TRUST</em></strong> it 100%.... </p>
  
  <p>Now, when it comes to the safety of output <code>DATA</code> from a query such as: </p>
  
  <p><code>"SELECT * FROM table_name",</code></p>
  
  <p>A malicious code like: <code>OR 1=1</code> will NOT affect the <code>Database</code>... However, now that <code>PDO</code> only took care of the <code>DATA</code> when being stored in the <code>DB</code> for <code>DB</code> Protection, on <strong>output</strong>, if a <code>column</code> contains <em>malicious</em> code like <code>"&lt;script&gt;alert("Hacked")&lt;/script&gt;"</code>, this seems to <code>alert</code> <strong>"Hacked"</strong> in the user's browser.</p>
  
  <p>What precautions is there for this?</p>
  
  <p>Do we have to <code>htmlentities</code> or <code>htmlspecialchars</code> the <code>data</code> <em>manually</em> or <strong>what is the best way to secure both the Storing and retrieving and displaying of <code>DATA</code>?</strong></p>