php - Escaping while using PDO -

i love using pdo in php don't bind because there addition of codes etc.. cannot ignore sql injection , other security holes.

i use php wrapper class php pdo wrapper class

i heard escaping prevents sql injection (is correct)?

i heard doing html special chars don't prevent sql injection?

can way escape data post ?

for example use insert in database using run statement (using php wrapper class)

$firstname=$_post["first_name"]; , many more variables  global $db;  $db->run(sprintf("insert users (usergroup, useremail, username, usertoken, userfirstname, userlastname, userpassword, verified, signupdate, userip) values ('1', '%s', '%s', '%s', '%s', '%s', '%s', 'y', '%s', '%s')", $email, $username, md5(time()*rand(1, 9999)),$firstname, $lastname, $password, time(),$_server[remote_addr])); 

is above code vulnerable sql injection , there security holes

you talking here 2 kinds of injection :

1. sql injection, use special characters " or ' modify request being executed. can avoided escaping values in request, or preparing statements (see here complete explanation).
2. html injection, use variables displayed in html inject code directly page. can avoided using htmlspecialchars, , has nothing sql injection.

you can't use htmlspecialchars prevent sql injection. simpler way prepare statements (see here). if don't it, there not code added , it's secure way it.

you can use pdo::quote (see doc here). request is vulnerable, can use quote function on each parameter secure it. tend find more verbose (compared preparing , binding), code.

i read library page, , didn't found documentation helpful, read code , found literally extends pdo, can use quote function pdo (or preparing, binding, etc).