title: Is this code safe against mysql injections?
body: <pre><code>$stmt_update = $db-&gt;prepare("UPDATE 2_1_journal SET RecordDay = ?,  WHERE Number = ? ");
  $stmt-&gt;execute(array($amount1, $date_day1));
  </code></pre>
  
  <p>Is this safe against mysql injections?</p>
  
  <p>If safe, as I understand it is because of "= ?". Then question how "= ?" works/helps</p>
  
  <p>Question is because here <a href="http://php.net/manual/en/pdo.prepare.php" rel="nofollow noreferrer">http://php.net/manual/en/pdo.prepare.php</a> is written </p>
  
  <blockquote>
    <p>Prepared statements only project you from SQL injection IF you use the bindParam or bindValue option.</p>
    
    <p>For example if you have a table called users with two fields, username and email and someone updates their username you might run</p>
  
  <pre><code>UPDATE `users` SET `user`='$var'
  </code></pre>
    
    <p>where $var would be the user submitted text.</p>
    
    <p>Now if you did</p>
  
  <pre><code>&lt;?php
  $a=new PDO("mysql:host=localhost;dbname=database;","root","");
  $b=$a-&gt;prepare("UPDATE `users` SET user='$var'");
  $b-&gt;execute();
  ?&gt;
  </code></pre>
    
    <p>and the user had entered  User', email='test for a test the injection would occur and the email would be updated to test as well as the user being updated to User.</p>
  </blockquote>
  
  <p>In my code (above) there is no bindParams and no bindValue. So do not know if it is safe and if yes, then what part of code ensures it. Please, advice</p>
  
  <p><strong>Update</strong></p>
  
  <p>After reading this <a href="https://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php?rq=1">How can I prevent SQL injection in PHP?</a> have got one more question</p>
  
  <p>Does this code </p>
  
  <pre><code>$stmt = $pdo-&gt;prepare('SELECT * FROM employees WHERE name = ?');
  $stmt-&gt;execute(array($name));
  </code></pre>
  
  <p>the same as this?</p>
  
  <pre><code>$stmt = $pdo-&gt;prepare('SELECT * FROM employees WHERE name = :name');
  $stmt-&gt;execute(array(':name' =&gt; $name));
  </code></pre>
  
  <p>If yes, then seems it is better to use first code because it is shorter?</p>