PHP prepared statements clarification - php

Question

Can you mix user input data with fixed data in a prepared statement security wise or does each query condition have to have a placeholder?
For example:
$code = htmlspecialchars($_GET['code']); // USER INPUT DATA
$status = 'A'; // FIXED
$stmt = $connect->prepare("SELECT s_id FROM events WHERE s_code = ? AND s_status = ?") or die(mysqli_error());
$stmt->bind_param('ss', $code, $status);
$stmt->execute();
$stmt->bind_result($reference);
Or is this also acceptable?
$code = htmlspecialchars($_GET['code']); // USER INPUT DATA
$stmt = $connect->prepare("SELECT s_id FROM events WHERE s_code = ? AND s_status = 'A'") or die(mysqli_error());
$stmt->bind_param('s', $code);
$stmt->execute();
$stmt->bind_result($reference);

Answer 1

Both approaches are acceptable. Obviously there's no security impact in binding a fixed value from your code, but it may have some performance benefits if various parts of your application (or even different applications) use different hard-coded values for that query.

Answer 2

To complement the answer provided by Mureinik, you should also focus on the user input a bit. Prepared statements are effective at preventing SQL injection attacks, but they are not a universal antidote against all types of attacks.
Judging by your example I would say you expect the $_GET['code'] to be an integer. As an extra layer of security you can (and should) sanitize and also validate the user input. Something along these lines:
// avoid accessing directly super-globals like $_GET, $_POST
// #see Sanitize filters: http://nl1.php.net/manual/en/filter.filters.sanitize.php
$code = filter_input(INPUT_GET, 'code', FILTER_SANITIZE_NUMBER_INT);
// #see Validate filters: http://nl1.php.net/manual/en/filter.filters.validate.php
$options = array(
'options' => array(
'min_range' => 1,
'max_range' => 1000000,
));
if (!filter_var($code, FILTER_VALIDATE_INT, $options)) {
echo 'Invalid code!';
}