PHP: Prepared statements (newbie), 只需要确认一下 SQL injection