php - What is PDO , how it's related with sql injection & why i should use this? -

Actually I did Google and got so many results, but I do not understand, 'I'm new in this field Am So any 1 can tell me in simple ways that what is PDO, why should I use it, what is SQL injection with example. Actually now my code is so that someone can help me ???

config.php

  & lt ;? Php $ mysql_hostname = "localhost"; $ Mysql_user = "root"; $ Mysql_password = ""; $ Mysql_database = "testdb"; $ Prefix = ""; $ Bd = mysql_connect ($ mysql_hostname, $ mysql_user, $ mysql_password) or die ("Could not connect to database"); Mysql_select_db ($ mysql_database, $ bd) or die ("database could not be selected"); ? & Gt;   
 insert.php  
  & lt ;? Include php ('config.php'); $ Account_no = $ _ post ['account_no']; $ Amount = $ _ post ['amount']; $ Save = mysql_query ("Include table mirror (account_no, volume) values ​​('$ account_no', '$ amount',")); Header ("location: index.html"); Go out(); ? & Gt;   
 index.html  
  & lt; Html & gt; & Lt; Body & gt; & Lt; Form action = "amount.php" method = "post" encrypt = "multipart / form-data" name = "addroom" & gt; Account number & lt; Br / & gt; & Lt; Input name = "account_no" type = "text" /> gt; & Lt; Br / & gt; Amount & lt; Br / & gt; & Lt; Input name = "zodiac" type = "text" /> gt; & Lt; Br / & gt; & Lt; Input type = "submit" name = "submit" value = "submit" id = "button1" /> & Lt; / Form & gt; & Lt; / Body & gt; & Lt; / Html & gt;    
 
 
   PDO - PHP data object   is a database access level that provides a similar method of access to multiple databases.  
  This is not an account for database-specific syntax, but allows the process of switching databases and platforms. In many instances, switching the connection string is quite painless.   
   
 Ready Query with statement / parameter is enough to prevent the first order injection on that statement. If you use somewhat more dynamic SQL in your application, then you are still weak for 2 order injections.  
 The second order injection means that the data has been cycled through the database once it is included in a query, and the API is very difficult to pull off, you actually get the actual 2 order attacks Never see, because it is normally easy for social engineers.  
 The PDO is a bit slow  mysql  _ *, but it has great portability PDO provides a single interface in many databases. This means that you can use multiple db for mysql, mssql_query without using mysql_query for MS SQL etc. Just  $ db-> Use something like query ("INSERT INTO ...")  There is always nothing that you are using the DB driver. Therefore, better for big or portable project PDOs SDL Injection SQL Injection is a technique where malicious users can include SQL commands in web site input through SQL statement.  
 
 / P> 
 Injected SQL commands can change SQL statements and compromise with the security of web applications.  
 
  Is PDO prepared statement enough to stop SDL injection?   
 A short answer  No,  The PDO will be ready   will not protect you from all possible SQL-injection attacks.   attacks   
 An example:  
  $ stmt = $ dbh- & gt; Ready ("SELECT * FROM TABLES WHERE names =: name"); $ Stmt- & gt; Execute (array (': name' = & gt; $ name));             >