No, you put in placeholders like ? in the query string, and supply replacement parameters out-of-band separately. See for example the bindValue api in the PHP D

No, you put in placeholders like ? in the query string, and supply replacement parameters out-of-band separately. See for example the bindValue api in the PHP DBAL API: http://docs.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/data-retrieval-and-manipulation.html http://docs.doctrine-project.org/projects/doctrine-dbal/en/l... This way, possibly-user-supplied values are never mixed with the query string, and you don't have to worry about quoting.