mysqli_prepare() prevents SQL injections?

[Mudsaf]

Hello, i'm wondering does MySQLi function..

mysqli_prepare()

..prevent SQL injections (check link)

http://stackoverflow.com/questions/14011899/mysqli-real-escape-string-should-i-use-it

[justsomeguy]

If you pass all user-entered data as bound parameters in a prepared query then the data will be properly escaped.

[Mudsaf]

I'm not quite following, so basically if i receive $_POST what was posted at INPUT form and lets say the input form name = test

//Does it work like this & what ist he question mark at SQL sentence. Is it the first binded parameter?. if ($stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {$stmt->bind_param("s", $_POST['test']);$stmt->execute();

[justsomeguy]

Yes, the question marks are placeholders for bound parameters.