Do I have to use mysql_real_escape_string if I bind parameters?

Question

I have the following code:

function dbPublish($status)
{
 global $dbcon, $dbtable;

 if(isset($_GET[\'itemId\']))
 {
  $sqlQuery = \'UPDATE \' . $dbtable . \         


        

Answer 1

function dbPublish($status)    
{    
 global $dbcon, $dbtable;    

 if(isset($_GET['itemId']))    
 {    
  $sqlQuery = 'UPDATE ' . $dbtable . ' SET active = ? WHERE id = ?';    
  $stmt = $dbcon->prepare($sqlQuery);    
  $stmt->bind_param('ii', $status, $_GET['itemId']);    
  $stmt->execute();    
  $stmt->close();    
 }    
}