Hi, 2 days ago teresko told my not to use mysql and I changed to PDO.
now,
1. I want to know if prepared statements are enough to protect from SQL Injection, here's an example of how I use it:
$pdo = new PDO('mysql:host=' . $db_host . ';dbname=' . $db_name, $db_user, $db_password);
$statement = $pdo->prepare("SELECT * FROM `sandsdb`.`stock` WHERE `InternalID`=:pid");
$statement->execute(array(':pid'=>$pid));
2. XSS can happen only when I echo variables from the user, which mean I need to use htmlentities($str, ENT_QOUTES, 'UTF-8') only, right? or I also need to escape the string?