title: Does oci_bind_by_name prevent SQL injection safely?
body: <p>I have read the documentation provided by oracle <a href="http://php.net/manual/en/function.oci-bind-by-name.php" rel="nofollow">here</a>, where it states that:</p>
  
  <p><code>Binding is important for Oracle database performance and also as a way to avoid SQL Injection security issues.</code></p>
  
  <p>How safe is it to use <code>oci_bind_by_name</code> to escape variables? Are there better practices to avoid SQL Injection, or does <code>oci_bind_by_name</code> suffice?</p>
  
  <p>TIA!</p>