title: Can I fully prevent SQL injection by PDO Prepared statement without bind_param?
body: <p>I am very new to PDO, sorry if you feel I am asking stupid question.<br/>
  Normal and simple PDO Prepared statement without <strong>Bind_param</strong> :</p>
  
  <pre><code>$sql = $db-&gt;prepare('SELECT * FROM employees WHERE name = ?');
  $sql-&gt;execute(array($name));
  $rows = $sql-&gt;fetchAll();
  </code></pre>
  
  <p>with <strong>Bind_param</strong> :</p>
  
  <pre><code>$sql-&gt;bind_param("s", $name); //s means the database expects a string
  </code></pre>
  
  <p>I heard people said : <strong>"The protection comes from using bound parameters, not from using prepared statement"</strong>. May I know what is <strong>bound parameters</strong>? <strong>Bind_param</strong> is <strong>bound parameter</strong>? If yes, then the normal and simple PDO Prepared statement without <strong>Bind_param</strong> CANNOT fully prevent SQL injection?</p>