As other people have noted, prepared statements aren't a security panacea, and string concatenation you do in the query can be vulnerable.