Is PDO prepared statements enough to protect against SQL injections?

Hello everyone! I'm a beginner PHP developer trying to understand security when working with databases. I've read many articles saying that PDO and prepared statements are a silver bullet against SQL injections. But I'm confused about a few points.\n\nHere's an example of my code:\n\n```php\n$pdo = new PDO('mysql:host=localhost;dbname=test', 'user', 'pass');\n$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");\n$stmt->execute([':username' => $_GET['username']]);\n$user = $stmt->fetch();\n```\n\nI think this is safe because I'm using placeholders. But then I saw this code in an old project:\n\n```php\n$pdo->query("SELECT * FROM users WHERE id = " . $_GET['id']);\n```\n\nAnd I became curious: what if I accidentally forget to use prepared