Preventing SQL Injection in user registration routine
It is safe.

You can improve your code like this:


no need to use closing ?&gt; in case that you are not outputting any HTML / or something else after your PHP code
no need to use "" to wrap strings in case that you don't have any variables inside a string, you can use '' instead, PHP interpreter does not need to check in that case whether there are any variables in the string or not
you can replace echo $e-&gt;getMessage; die() by simplier exit($e-&gt;getMessage());
I added salt generation to your code $salt = md5(uniqid(null, true));
I added password hashing to your code by $password = hash('sha256', $password . $salt);


The whole code hereunder:

&lt;?php

try {
    $handler = new PDO('mysql:host=localhost;dbname=s','root', '*');
    $handler-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e){
    exit($e-&gt;getMessage());
}

$name = $_POST['name'];
$username = $_POST['username'];
$email = $_POST['email'];
$password = $_POST['password'];

$salt = md5(uniqid(null, true));
$password = hash('sha256', $password . $salt);

$sql = '
    INSERT INTO userinfo 
        (name ,username, email, password, salt) 
    VALUES 
        (:name,:username,:email,:password, :salt)
';

$query = $handler-&gt;prepare($sql);

$query-&gt;execute(array(
    ':name' =&gt; $name,
    ':username' =&gt; $username,
    ':email' =&gt; $email,
    ':password' =&gt; $password,
    ':salt' =&gt; $salt
));