Another question: I read a bit more about prepared statements, and it seems you can't use them to verify table names etc; What should I do then, if I let the user specify, for example, in which order he wants to sort the result? (I'm requesting this data per GET so the user can change it easily, and thus, until now, I just verified if the variable in question either is equals to "desc" or "asc"...)

And why not simply use mysql_escape_string (Or something)? This is also a function that should include "prevention done by experts", so where is the advantage of prepared statements now, if you exclude performance?

EDIT: Nevermind, found the answer for my second question on google.