I just followed the first half dozen search results for "php tutorial mysql". All of them resort to pasting string literals into queries, with not a prepared statement in sight. One of PHP's problems is that it quickly reached a critical mass of self-perpetuating misinformation between the ignorant and the slightly less ignorant, ensuring unforgivable security blunders for years to come. At this point I don't know how anyone could solve this, short of dramatic language changes that make those crappy old tutorials obviously unusable.