Questions about automatic escape in PDO

I have read about the issue of automatic escape in PDO. if the prepare and execute methods are used, they can also prevent SQL injection and other attacks. Because all variables are automatically escaped. Then, I enter df 'dfdf & quot; in the form, and no data can be entered in the result. SQL statement: INSERTINTO
I read the book and said that using the prepare and execute methods can also prevent SQL injection and other attacks. Because all the variables will
Automatically escaped.
Then, I enter df 'dfdf "in the form, and no data can be entered in the result.
SQL statement: INSERT INTO cms_manage (admin_user, admin_pass, level, last_time) VALUES ('df 'dfdf "', 'Taobao', '6', NOW ())
Error message: SQLSTATE [42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'dfdf "', 'da39a3ee5e6b4b0d3255bfef95601890afd80709', 'At line 9
When I use the mysql_real_escape_string function to escape the data df 'dfdf ", it will be successful. whether prepare and execute can be automatically escaped or not should be manually escaped.

------ Solution --------------------
Of course!
However, you only post SQL commands and do not use the prepare and execute methods.
------ Solution --------------------
I think it is a problem with your code. the prepare () execute () combination of PDO can indeed prevent SQL injection.