always use prepare/execute for sql on pdo.