help with ADOdb!!

[seany123]

someone is now telling me that by using a query like this:

 

$query1 =$db->execute ("SELECT * FROM users WHERE ref='$user->id' && rm >='1'");
$amount = $query1->recordcount();

 

is easily hackable by a experienced hacker... however this isnt:

 

$query1=$db->execute("select * from `users` where `ref`=? and `rm`>=?",array($user->id, 1));
$amount=$query1->recordcount();

 

is that correct? opinions please?