A prepared statement separates the SQL from the values: you write the query with parameters (:nom or ?), prepare it with prepare, then run it with execute passing the values. The database treats these values as data, never as SQL.
Example
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);