Why no PDO?

[eluser]Unknown[/eluser]
[quote author="Rick Jolly" date="1296974597"]ispod, rest assured that mysql_real_escape_string() is completely safe. If it wasn't, most php applications would be vulnerable to sql injection attack.

Of course, we developers can screw anything up when we don't know what we are doing.[/quote]

I'm sorry, but this is bad advice. Parameterization is much safer than escaping query strings. Abstraction and security are the main reasons for the use of PDO. Performance is nothing but a side effect. If you want to improve query performance, you use sensible indexes and stored procedures (and beyond that sharding, clustering, etc.)

mysql_real_escape_string does very little to prevent injection attacks.