How to properly handle single quote in SQL query via PDO?

Question

PHP

Hello, I have a situation that is not clear to me.
Data is saved via

$sth = $this->db->prepare($sql);
$result = $sth->execute($params);

The data is stored in the database, but! PDO throws an error:

Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '[email protected]'' at line 1 in ...\application\model\M_Database.php on line 49

In $sth the quoted value is stored like this:
':email' => string(18) "a'[email protected]"
What am I doing wrong and how can I fix it?

Answer 1

https://secure.php.net/manual/en/pdostatement.bind...

Answer 2

And your SQL looks like this:
SELECT * FROM table WHERE email = ':email'
I would suggest changing it to:
SELECT * FROM table WHERE email = :email
Trust me, don't escape variables yourself