حماية من SQL Injection في PDO

ما هي افضل طريقة للحماية من الحقن

الطريقة الاولى :

/* Execute a prepared statement by passing an array of values */

$sql = 'SELECT name, colour, caloriesFROM fruit WHERE calories < :calories AND colour = :colour';

$sth = $dbh->prepare($sql);

$sth->execute(array(':calories' => 150, ':colour' => 'red'));

$red = $sth->fetchAll();

الطريقة الثانية

$sth = $dbh->prepare('SELECT name, colour, calories

FROM fruit
WHERE calories < ? AND colour = ?');

$sth->execute(array(150, 'red'));