Hacker News Reader

The problem is not which driver you use. It's whether you concatenate strings to form sql queries and then execute them against your database.

I think the point he was trying to make, was that using prepared statements with PDO or mysqli would prevent this

exactly.