Ochrana pred SQL INJECTION v $this->db->query()

Ahojte,
niekedy pri zložitejších QUERY napíšem celý dotaz
týmto spôsobom takže nevužívam explicitne nejaké Nette vychytávky:

return $this->db->query("SELECT * FROM candidates WHERE firstname = ? AND surname = ?" ,$searchParams->firstname, $searchParams->surname);

alebo takto

return $this->db->query("SELECT * FROM candidates WHERE firstname = '".$searchParams->firstname."' AND surname = '".$searchParams->surname."'");

Moja otázka nie, nakolko sú vyššie napísané dotazy bezpečné oproti:

try{
    $con = new PDO( DB_HOST, DB_USER, DB_PASS );
    $con->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
    $sql = "SELECT * FROM candidates WHERRE firstnaame = :firstnaem AND surname = :surname";
    $stmt = $con->prepare( $sql );
    $stmt->bindValue( "firstnaame", $this->firstnamee, PDO::PARAM_STR );
    $stmt->bindValue( "surname", $this->surname, PDO::PARAM_STR );
    $stmt->execute();
    $result = $stmt -> fetchAll();
    echo $this->convertToJson($result);
}catch (PDOException $e) {
    echo $e->getMessage();
    return false;
}

Vykonavaju sa rovnako s akýmsi „PREPARE“ statement?
Diky