php - Is this code safe against mysql injections? -

$stmt_update = $db->prepare("update 2_1_journal set recordday = ?,  number = ? "); $stmt->execute(array($amount1, $date_day1)); 

is safe against mysql injections?

if safe, understand because of "= ?". question how "= ?" works/helps

question because here http://php.net/manual/en/pdo.prepare.php written

prepared statements project sql injection if use bindparam or bindvalue option.

for example if have table called users 2 fields, username , email , updates username might run

update `users` set `user`='$var' 

where $var user submitted text.

now if did

<?php $a=new pdo("mysql:host=localhost;dbname=database;","root",""); $b=$a->prepare("update `users` set user='$var'"); $b->execute(); ?> 

and user had entered user', email='test test injection occur , email updated test user being updated user.

in code (above) there no bindparams , no bindvalue. not know if safe , if yes, part of code ensures it. please, advice

update

after reading how can prevent sql injection in php? have got 1 more question

does code

$stmt = $pdo->prepare('select * employees name = ?'); $stmt->execute(array($name)); 

the same this?

$stmt = $pdo->prepare('select * employees name = :name'); $stmt->execute(array(':name' => $name)); 

if yes, seems better use first code because shorter?

yes, prepared statements safe inject attacks long there no logical flaws, such using name = '?'.

bindparam helpful when want bind different datatypes; such string, integer etc in query. eg:

$stmt = $pdo->prepare('select * employees myid = ?'); $stmt->bindparam( 1, $id, pdo::param_int ); $stmt->execute();