Listing products from a database
Yes, $category in your query string, coming directly from $_GET is a problem.

You should validate $category, and that's not exactly the same as escaping. I assume you have a limited set of valid categories in your database, so validation should be something like:

$valid_categories = array("sector", "industry", "company");
if (!in_array($category, $valid_categories)) {
    // no no
}


As for the other part of your question, paraphrased:


  Is it pointless to use prepared statements if there is a variable part in the query?


It's not pointless, because every time you run the query for the same $category value, it can benefit from the previously prepared statement.