Vaguely when mysql code is injection proof using PDO

Question

I understand the basic idea of ​​how mysql statements can be vulnerable, but every time I try to find a useful guide, the ways to achieve this with PDO look different than others. In addition, they sometimes tell me in stackoverflow that my code is vulnerable, for example, on the day when it was said about the following (which does not work with BAT, but I was taught how to do it:

$search = $_GET["search"];
$searcharray = explode('|', $search);
$query=("SELECT username,sender,message,subject,timestamp,threadid,msgtype 

FROM Messages WHERE  ('" . implode("'|'",$searcharray) . "') IN CONCAT 
(message,subject)  ORDER BY timestamp");

.. but why? It would not be enough:

$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);

before the code and

$result = $conn->query($query)->fetchAll(PDO::FETCH_OBJ);

then?

, , , , SELECT, ? , , PDO-ify mysql, SELECT, UPDATE, INSERT ..

!

Answer 1

, , (, $_GET) , :

$search = $_GET["search"];
$searcharray = explode('|', $search);
$query=("SELECT username,sender,message,subject,timestamp,threadid,msgtype 

FROM Messages WHERE  :searchParams IN CONCAT 
(message,subject)  ORDER BY timestamp");

$query = $conn->prepare($query);
$query->execute(['searchParams' => implode("'|'",$searcharray)]);

, .