PDO should be the default option for everyone connecting to a db from php.
And beyond that, you should always use prepared statements/bind variables in any environment.
Beyond security, they are more performant.
For small projects you won't see a difference but for bigger things, you save DB hard parses. In other words, if you constantly send
SELECT FROM superheroes WHERE ready_for_combat = 1 and location = 'HQ' and injured = 0;
then every time the DB engine has to parse that. This is a huge headache for all these goofy ORM engines that construct SQL on the fly - there's virtually no reuse of prepared statements because it's all dynamically generated SQL.
If however you prepare a statement with
SELECT FROM superheroes WHERE ready_for_combat = ? and location = ? and injured = ?;
then if you make 1,000 calls, there is only one parse on the first call. On subsequent calls the DB is just plugging in variables. Of course, could be SELECT, INSERT, UPDATE, etc.
You don't see these savings if you have only a few calls of course - CPUs are fast today. But if you're doing tons of DB calls and tons of clients are banging on your DB server, it adds up to significant CPU savings.
Some of the big commercial engines like Oracle will actually analyze on the fly and convert to bind-variables invisibly for you, but it's obviously better to do it yourself.
Besides, prepared statements/bind variables just a saner, sturdier way of dealing with the DB.
Being able to say (pseudo code)
sql_handle->execute($var1, $var2);
is so much nicer than having to quote a bunch of variables.
