As long as you use prepared statements correctly.<p>I can&#x27;t tell you how many times I&#x27;ve seen someone passing a query though the prepared query method but still crafting the query dynamically<p>Stuff like:<p>prepareQuery(&quot;SELECT something FROM table WHERE col=&#x27;&quot;+userInput+&quot;&#x27; and otherCol=?&quot;, otherUserInput);<p>That is still vulnerable even though prepared statements are in use. As long as user input doesn&#x27;t find its way into the query string though you should be safe from these assuming the issue isn&#x27;t internal like bad stored procedures creating queries based on input.