php - Parameterized Query -

pls code secure?

/* create new mysqli object database connection parameters */ $mysqli = new mysql('localhost', 'username', 'password', 'db');  if(mysqli_connect_errno()) { echo "connection failed: " . mysqli_connect_errno(); exit(); }  /* create prepared statement */ if($stmt = $mysqli -> prepare("select priv testusers username=? , password=?")) {  /* bind parameters s - string, b - boolean, - int, etc */ $stmt -> bind_param("ss", $user, $pass);  /* execute */ $stmt -> execute();  /* bind results */ $stmt -> bind_results($result);  /* fetch value */ $stmt -> fetch();  echo $user . "'s level of priviledges " . $result;  /* close statement */ $stmt -> close(); }  /* close connection */ $mysqli -> close(); 

as far protection against mysql injection concerned: yes. mysqli's parametrized queries safe against injection attacks.

if $user comes external source, may want add htmlentities() echo statement prevent users signing user name <script>(some malicious code)</script>