Does this generic query follow good OOP standards? I am trying to convert over to MySQLi and wanted expert advice.  Is the enclosed code 100% OOP.  Also, how secure is the code against attacks?  I know nothing is 100% secure, but how good/safe is it?  How and what can I make better?  This is just a generic query as I wanted to get a basic model setup.

&lt;?php
define ('DB_HOST', 'localhost');                       //  Host name
define ('DB_USER', 'root');                            //  Mysql username
define ('DB_PASSWORD', 'password');                    //  Mysql password
define ('DB_NAME', 'database');                        //  Database name

// New Connection
$mysqli = new mysqli(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME);

require("dbcon.php");  // This is actually the code above in a separate file that I have included here for checking.

$query = "SELECT id, username, firstname FROM users WHERE firstname=?";

if ($stmt = $mysqli-&gt;prepare($query))
{
   // Bind the variables
   $firstname = $_POST[first_name];

   // Bind parameters  s - String, b - Boolean, i - Integer etc
   $stmt-&gt;bind_param("s", $firstname);
   // Execute it
   $stmt-&gt;execute();
   // Store it for num rows
   $stmt-&gt;store_result();
   $num_rows = $stmt-&gt;num_rows;
   // Assign blank variables
   $id = "";
   $username = "";
   $firstname = "";
   // Bind the result and retrieve the data
   $stmt-&gt;bind_result($id, $username, $firstname);
      if(($num_rows) &gt; 0)
      {
         while($stmt-&gt;fetch())
         {
            echo $id;
            echo "&lt;br /&gt;";
            echo $username;
            echo "&lt;br /&gt;";
            echo $password;
            echo "&lt;br /&gt;";
            echo "Number of rows: ", $num_rows;
            echo "&lt;br /&gt;";
            echo "&lt;br /&gt;";
         }
      }
      else
      {
         echo "No records";
      }
   // Close the statement
   $stmt-&gt;close();
}
// Close connection
$mysqli-&gt;close();
?&gt;
Your binding of parameters will help in preventing SQL injections.

You need to sanitize your data first though.
You need to treat everything that comes from a user (passed from the client machine) as 'dirty' and not allow it into your system before it's been 'cleaned'. Your first step would be to clean it - converting all HTML tags and special characters into their HTML entities htmlspecialchars() htmlentities() (well as long as HTML isn't allowed). This will help prevent cross-sight scripting (XSS). Typically then you would move on to validating the data - making sure it's in a format you expect. Then if it's not you return it to the user with an error.
This is also assuming that you've checked the user has permission to run this function, if relevant.