Example about prepare statements. No SQL Injections... no bugs, be safe

prepare.php

<?php
$servername = "localhost";
$username = "root";
$password = "toor";
$dbname = "test";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// prepare and bind
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);

// set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "[email protected]";
$stmt->execute();

$firstname = "Mary";
$lastname = "Moe";
$email = "[email protected]";
$stmt->execute();

$firstname = "Julie";
$lastname = "Dooley";
$email = "[email protected]";
$stmt->execute();

echo "Records are inserted successful !";

$stmt->close();
$conn->close();
?> 

The above example is Prepared Statements in MySQLi

The argument (in $stmt->bind_param ...) may be one of four types:

• i - integer
• d - double
• s - string
• b - BLOB