title: How to protect INSERT input from SQLi with MySQLi?
body: <p>I have this code on a contact page of my site:</p>
  
  <pre><code>$insert = $mysqli-&gt;prepare("INSERT INTO `contact` (`Name`, `Email`, `Subject`, `Priority`, `DisplayName`, `Message`, `IP`) VALUES (?,?,?,?,?,?,?)");
  $insert-&gt;bind_param('sssisss', $_POST['name'], 
  $_POST['email'],
  $_POST['subject'],
  $_POST['priority'],
  $_POST['dispname'],
  $_POST['query'],
  $ip);
  
  $insert-&gt;execute();
  $newId = $insert-&gt;insert_id;
  $insert-&gt;close();
  </code></pre>
  
  <p>It works fine, however, is my prepare statement enough to protect against SQLi attacks?
  This is my first project since moving over from mysql_* (I know, bad of me, but now I'm making the change) and I am wondering if I am meant to escape anything else before inserting these values?</p>