PDO Prepare bindParam, DBAL Prepare bindValue ปลอดภัยจริงอะป่าว?

// SQL Prepared Statements: Positional
$sql = "SELECT * FROM users WHERE username = ?";
$stmt = $connection->prepare($sql);
$stmt->bindValue(1, $_GET['username']);
$stmt->execute();

$options['module_enable'] = 1;
$options['site_id'] = '\'; DROP TABLE an_modules;';

$sql = 'SELECT * FROM `'.$this->Db->getTableName('modules').'` AS `m`';
        $sql .= ' LEFT JOIN `'.$this->Db->getTableName('module_sites').'` AS `ms` ON m.module_id = ms.module_id WHERE 1';
        if (isset($options['module_enable'])) {
            $sql .= ' AND `module_enable` = :module_enable';
        }
        if (isset($options['site_id'])) {
            $sql .= ' AND `site_id` = :site_id';
        }
        if (isset($options['module_id'])) {
            $sql .= ' AND m.module_id LIKE :module_id';
        }

        $stmt = $this->Conn->prepare($sql);
        if (isset($options['module_enable'])) {
            $stmt->bindValue('module_enable', $options['module_enable'], \PDO::PARAM_INT);
        }
        if (isset($options['site_id'])) {
            $stmt->bindValue('site_id', $options['site_id'], \PDO::PARAM_INT);
        }
        if (isset($options['module_id'])) {
            $stmt->bindValue('module_id', '%'.$options['module_id'].'%', \PDO::PARAM_INT);
        }
        $stmt->execute();