title: plain mysql prepare statement prevent injection attack?
body: <p>Everyone knows that PDO prepare statement helps us prevent SQL injection attack. How about this:</p>
  
  <pre><code>function userQuery($username){
      $mysqli-&gt;multi_query("
          PREPARE stmt1 FROM 'SELECT * FROM user WHERE username=?';
          SET @a = '$username';
          EXECUTE stmt1 USING @a
      ");
  }
  userQuery('Kelvin');
  </code></pre>
  
  <p>Is this as safe as mysqli or PDO prepare statement?</p>
  
  <p>I'm asking this question because I found these sentences on <a href="http://en.wikipedia.org/wiki/Prepared_statement" rel="nofollow"><strong>wiki</strong></a>:</p>
  
  <blockquote>
    <p>Prepared statements are resilient against SQL injection, because parameter values, which are transmitted later using a different protocol, need not be correctly escaped. If the original statement template is not derived from external input, SQL injection cannot occur.</p>
  </blockquote>
  
  <p>They mention about <code>parameters are transmitted later with different protocol</code>. And I don't really understand 
  this.</p>
  
  <p>How can <code>parameters are transmitted later with different protocol</code> prevent injection attack?</p>