xss comments
pdo driver has a proper error function