title: Can't escape single quotes inside an array even after PDO prepare statement and bind params
body: <p>I'm working with two identical tables from SQL Server and MySQL and my end-goal is to be able to sync their contents through PHP. I made a <a href="https://stackoverflow.com/questions/55796894/trying-to-sync-tables-from-sql-server-and-mysql-query-error-when-trying-to-sele">previous post</a> about this and I found out that the reason my code wasn't working was because of single quotes messing up my SQL Syntax. I then converted my table to use PDO instead because I heard preparing statements/binding param through it is more efficient. However, my code is still not escaping single quotes properly. I've already look into past posts but none of them solved my problem. Here is the code:</p>
  
  <pre><code>&lt;?php
  
  $serverName = "&lt;servername&gt;";
  $connectionInfo_mssql = array("Database"=&gt;"&lt;dbname&gt;", "CharacterSet"=&gt;"UTF-8");
  
  try
    {
      $conn_mssql = new PDO("sqlsrv:Server=$serverName;Database=&lt;dbname&gt;");
      $conn_mssql-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  
      $conn_mysql = new PDO("mysql:host=localhost;dbname=&lt;dbname&gt;", "", "");
      $conn_mysql-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  
  
      //SELECT FROM SQL SERVER DB
      $mssql_array = array();
      $mssql_query = $conn_mssql-&gt;prepare("SELECT * FROM Customers");
      $mssql_query-&gt;execute();
  
      while($row = $mssql_query-&gt;fetch(PDO::FETCH_BOTH))
      {
  
        $mssql_array[] = array('ID' =&gt; $row['ID'], 
                               'Name' =&gt; $row["Name"], 
                               'Address' =&gt; $row['Address'], 
                               'Email' =&gt; $row['Email']);
  
      }
  
      foreach($mssql_array as $key =&gt; $value)
      {
  
         //SELECT FROM MySQL DB
         $mysql_query = $conn_mysql-&gt;prepare("SELECT COUNT(*) FROM Customers WHERE ID ='".$value['ID']."' 
                                                          AND Name = '".$value["Name"]."' 
                                                          AND Address = '".$value['Address']."' 
                                                          AND Email = '".$value['Email']."' ");
         $mysql_query-&gt;execute();
         $num_rows = $mysql_query-&gt;fetchColumn();
  
         if ($num_rows == 0)
                         {
                           //INSERT INTO MySQL DB
                           $sql = $conn_mysql-&gt;prepare("INSERT INTO Customers VALUES (:ID, :Name, :Address, :Email)");
  
                           $params = array(':ID' =&gt; $value["ID"], ':Name' =&gt; $value["Name"], ':Address' =&gt; $value["Address"], ':Email' =&gt; $value["Email"]); 
                           $sql-&gt;execute($params); //this is where the error occurs
                         }
      }
  
      echo 'Table Customers from MS SQL DB and table Customers from MySQL DB are now synced!'."&lt;br&gt;";
      echo "&lt;a href='table_updater.php'&gt;Go back to updater&lt;/a&gt;";
  
    }
  catch(PDOException $e)
    {
      echo "Error: " . $e-&gt;getMessage();
    }
  
  ?&gt;
  </code></pre>
  
  <p>What this basically does is it selects all of the SQL Server table's contents and puts it in MySQL, but since one of my rows has the value "Jojo's" it just gives me an error because of the single quote. The error I'm getting is </p>
  
  <blockquote>
    <p>Error: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 's' AND Address = 'IDK''</p>
  </blockquote>
  
  <p>which pretty much tells me that I'm not escaping the single quote.</p>
  
  <p>Any ideas are much appreciated!</p>