Using prepared statements in PDO

gistfile1.php

<?php
$db = new PDO('mysql:host=hostname;dbname=defaultDbName', 
              'username', 'password', 
              array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8"));

$query = 'SELECT * FROM my_table WHERE title = :title';

$stmt = $db->prepare($query);
$stmt->bindValue(':title', $myTitle);
$stmt->execute();

while($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
  // ...
}
?>

Explanation at https://lazycat.org/php-prepared-statements.html

Also mentioned in https://lazycat.org/php-output-escaping.html