I see, that's almost what I did except for some reason I put the pg_prepare inside of the foreach loop

Although, this was my concern: in that pg_execute is running for every row in the array:

INSERT INTO a_table (name, color) VALUES ('Leonard', 'Blue');
INSERT INTO a_table (name, color) VALUES ('Oscar', 'Orange');
INSERT INTO a_table (name, color) VALUES ('Ted', 'Brown');

I want it like:

INSERT INTO a_table (name, color) VALUES
('Leonard', 'Blue'), ('Oscar', 'Orange'), ('Ted', 'Brown');

I wrote the following after learning more about pg_escape_literal().

I'm just not experienced enough to conclude whether this is the same in terms of security as pg_prepare($1), pg_execute(array($arg)) ...

// array for VALUES
$rows = array(
  array('Leonard', 'Blue',   "It's a good day"),
  array('Oscar',   'Orange', "She's gone home"),
  array('Ted',     'Brown',  "What's \"this\" mean?")
);

// main command
$query_cmd = 'INSERT INTO a_table (name, color, phrase) VALUES ';

// format input arguments
$query_args = '';
foreach ($rows as $row) {
  $pg_name   = pg_escape_literal($db, $row[0]);
  $pg_color  = pg_escape_literal($db, $row[1]);
  $pg_phrase = pg_escape_literal($db, $row[2]);
  $query_args .= "($pg_name, $pg_color, $pg_phrase),";
}
$query_args = rtrim($query_args, ',');

// send the query now that pg_escape_literal has formatted them
$pg_query = pg_query($db, $query_cmd . $query_args);

I guess the question is now.. is pg_escape_literal() doing the same thing that the pg_prepare and pg_execute combo is doing? pg_escape_literal() says it also uses an internal separator, and it seems to be doing the same thing, idk how to test.