Checking whether a user is on the donors list I was wondering if I could please get some justification if the PHP code I wrote using Mysqli prepared statements would be able to withstand SQL injection attacks.

I have one field that gets a value from a form. Code works 100% fine, just want to make sure it is secure against SQL injection.

$steaminput = filter_input(INPUT_POST, 'steamid_user', FILTER_SANITIZE_STRING);
$conn = mysqli_connect(host, user, pass, table);
$sql = "SELECT username, activated, expiration_date FROM donors WHERE steam_id=?";

$stmt = mysqli_prepare($conn, $sql);

mysqli_stmt_bind_param($stmt, "s", $steaminput);

mysqli_stmt_execute($stmt);

mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);



  while(mysqli_stmt_fetch($stmt)){
    $data = array('username'=&gt;$username_res, 'activated'=&gt;$activated_res, 'expiration_date'=&gt;$expiration_res);
  }


mysqli_stmt_close($stmt);
mysqli_close($conn);
//I use array information from retreival here
The final parameter here is misnamed:

$conn = mysqli_connect(host, user, pass, table);


It denotes name of MySQL database (e.g. "test") rather than name of a table (e.g. "test.donors" or "donors.donors").

The _res suffix is superfluous and may be safely elided:

mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);



  want to make sure it is secure against SQL injection.


Yes, you are using the API as recommended, in secure fashion.