[PDO] - dubbio su sicurezza e performance.

[cichity74]

Sto migrando a PDO, ed ho dei dubbi in merito alla sicurezza (SQL injection) e performance,
vorrei sapere tra i seguenti metodi quale è il più sicuro / veloce;
metodo 1: prepare bindValue & execute
metodo 2: prepare execute array

<?php 
// test pdo
try {
    $dsn='mysql:host=localhost;dbname=mydb;charset=utf8';
    $username='*****';
    $password='******';
    $dbh = new PDO($dsn, $username, $password);
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
}catch(PDOException $e){
    print_r($e->getMessage());
}
//URL ?id_categoria=13&id_marca=1&keyword=a 
    $id_categoria=$_GET['id_categoria'];
    $id_marca=$_GET['id_marca'];
    $keyword=$_GET['keyword'];
//--------------------------------------------------------------------------------------------
// 1 Test bindValue
//--------------------------------------------------------------------------------------------
$sql='SELECT * FROM `prodotti` WHERE `id_categoria`=? AND `id_marca`=? AND `prodotto` LIKE ? LIMIT 10';
$sth=$dbh->prepare($sql);
$sth->bindValue(1, $id_categoria, PDO::PARAM_INT);
$sth->bindValue(2, $id_marca, PDO::PARAM_INT);
$sth->bindValue(3, "%$keyword%", PDO::PARAM_STR);
$sth->execute();
echo '<pre>';
echo "1 Test bindValue\n";
while($row=$sth->fetch(PDO::FETCH_ASSOC)){
    echo 'id_categoria -> '.$row['id_categoria']."\n";
    echo 'id_marca -----> '.$row['id_marca']."\n";
    echo 'prodotto -----> '.$row['prodotto']."\n";
    echo "-------------------------------------------------------------\n";
}
echo '</pre>';
//--------------------------------------------------------------------------------------------
// 2 Test execute array
//--------------------------------------------------------------------------------------------
$sql='SELECT * FROM `prodotti` WHERE `id_categoria`=? AND `id_marca`=? AND `prodotto` LIKE ? LIMIT 10';
$sth=$dbh->prepare($sql);
$sth->execute(array((int)$id_categoria, (int)$id_marca, "%$keyword%"));
echo '<pre>';
echo "2 Test execute array\n";
while($row=$sth->fetch(PDO::FETCH_ASSOC)){
    echo 'id_categoria -> '.$row['id_categoria']."\n";
    echo 'id_marca -----> '.$row['id_marca']."\n";
    echo 'prodotto -----> '.$row['prodotto']."\n";
    echo "-------------------------------------------------------------\n";
}
echo '</pre>';
?>

Grazie