title: SELECT within SELECT PDO prepared statement
body: <p>I'm thinking of an example like this one:</p>
  
  <p>The request hits a page at an url (by whichever means), with a parameter. <code>example.com/api/page?name=bob</code>. It's my understanding that you should do a prepared statement to get the <code>$_POST[name]</code>parameter and make sure it's not anything funky, but it does so by evaluating the expression. </p>
  
  <p>My first question is: How does it do so (evaluate the expression)?</p>
  
  <p>My second question is: 
  What if a user inputs something along the lines of "SELECT * FROM users" or "DROP TABLE users" that gets passed to the <code>$_POST['name']</code> parameter (the <code>?name=bob</code> at the end), what would happen in that case?</p>
  
  <p>Just as an example, the final query would be something like </p>
  
  <pre><code>SELECT name, continent FROM world
  WHERE continent IN
  (SELECT continent FROM world WHERE name='Brazil')
  </code></pre>
  
  <p>the second select acting as the user input parameter - so <code>$_POST['name']</code> contains this query <code>SELECT continent FROM world WHERE name='Brazil'</code></p>
  
  <p>Lastly, the third question i have is how can i protect against something like that? </p>
  
  <p>I'm guessing PDO is design specifically to prevent query within query(?), but after reading around a bit i'm still quite confused.</p>
  
  <p>I'm still learning all of this so if i'm not clear or specific enough in my inquiry please let me know, and i'll try and address that.</p>
  
  <p><strong>EDIT:</strong>
  To clear any confusion, what i'm doing is this:</p>
  
  <pre><code>$pdo = new PDO('..');
  $sql = 'SELECT id FROM users WHERE username = :username';
  $statement = $pdo-&gt;prepare($sql);
  $statement-&gt;bindParam(':username', $_POST['username']);
  </code></pre>
  
  <p>Question is, what if <code>$_POST['username']</code> contains <code>'SELECT * FROM users'</code> (or any other query) ?
  How does <code>prepare()</code> work? Can what i described actually present a security hole? I need some help in understanding this.</p>