使用预准备语句但引号未被转义或删除

Question

I am having an issue getting some things to insert into my database. If I put quotes single or double into my text fields it will break the query and will not escape them. I just got done reading that using prepared statements eliminates the need to call mysql_real_escape_string. Can someone tell me if I am executing my query wrong. $companyInfo is an array that contains about 8 rows to be inserted.

function InsertCompanyInfo($companyInfo, $conn) {
    foreach($companyInfo as $key => $table) {           
        $keys = array_keys($table);
            $values = null;
            $x = 1;

            foreach($table as $row => $value) {
                $values .= "'$value'";
                if($x < count($keys)) {
                    $values .= ', ';

                }
                $x++;
            }

        $sql = $conn->prepare("INSERT INTO {$key} (`" . implode('`, `', $keys) . "`) VALUES ({$values});");
        $sql->execute();
        $CompanyID = $conn->lastInsertId('CompanyID');
    }
    return $CompanyID;
}

This is the error I get when I insert qoutes:

    Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax
 error or access violation: 1064 You have an error in your SQL syntax; check the manual that
 corresponds to your MySQL server version for the right syntax to use near '1', 
''''"'"''"';;''';';')' at line 1' in /var/www/Survey/InsertFunctions.php:20 Stack trace: #0
 /var/www/Survey/InsertFunctions.php(20): PDOStatement->execute() #1 
/var/www/Survey/testProcess.php(8): InsertCompanyInfo(Array, Object(PDO)) #2 {main} thrown 
in /var/www/Survey/InsertFunctions.php on line 20

Answer 1

Prepared statements work by separating the query structure and the values in code like so:

$stmt = $pdo->prepare('INSERT INTO foo (bar) VALUES (?)');

This is the query structure, which the database is given first to understand. Then you give it the values separately:

$stmt->execute(array('baz'));

What you're doing instead is you call prepare on a completely formed query which includes crudely interpolated values. There's nothing prepare can do here. The entire problem of escaping values is that the database cannot figure out what a value was and what your part of the query was after the fact. If you're giving the query fully formed and incorrectly escaped to the database, it can't magically recognise what was supposed to be what. You need to add placeholders to the query and provide the corresponding values in a separate step.