True prepared statements

By default, PHP prepares statements natively (i.e. within PDO). Setting this to false means statements get sent to the server to get prepared which mitigates injection attacks involving multibyte characters, etc, though it has a slight effect on performance. I haven't profiled it or anything but I'm sure the performance hit will be negligible.