Database Security, mysqli and prepared statements

[eluser]Unknown[/eluser]
I think I understand now why CI does not support prepared statements: CI wants to support PHP4 and in PHP4 the only libraries that support prepared statements are vendor-specific libraries such as MySQLi (which is only for MySQL). In PHP5 we have "PHP Data Objects" which is a vendor-agnostic library that supports prepared statements.

I am taking a serious look at the Yii Framework. It seems to have most of the advantages of CI (good documentation, MVC-but-flexible, high performance) with some additional advantages (for me) such as using prepared statements. Yii does not support PHP4 but I'm cool with that. I don't care about PHP4.