title: Do I have to sanitize user input with prepared SQL statements?
body: <p>Is this considered completely safe?</p>
  
  <pre><code>$stmt = $dbhandler-&gt;prepare("update sometable set somefield=:somestring");
  $stmt-&gt;bindParam(":somestring",$_REQUEST["hack_me_please"],PDO::PARAM_STR);
  $stmt-&gt;execute();
  </code></pre>
  
  <p>And if not, what could make it safer? I'm assuming there are unknown vulnerabilities in PDO/MySQL/PHP that may be exploited in the future so I'm wondering if there is anything reasonable I can do make my queries safer, or is it out of my hands with prepared statements.</p>
  
  <p>If it is this easy, why is SQL injection still a thing? Shouldn't it have gone the way of polio?</p>