Php parameterized query

When learning to inject php parameterized queries, an injection point appears in MetInfo cms. I found the source code:

$ Show = $ db-> get_one ("SELECT * FROM $ met_column WHERE id = $ id and module = 1 ");

If you don't understand php, you may mistakenly think it is parameterized. Isn't parameterization able to prevent injection? how can there be injection points.

Later, I learned more about it. Parameter queries refer to database interface parameterization instead of program-level parameters. Form:

Fetch_one ('select * from user where name =? ', @ Name)

Php uses parameter queries to prevent injection.

Php parameter query materials

• Use parameterized query to prevent SQL injection
• Using parameterized query in PHP