Are filter_input() and $stmt = $mysql->prepare() really enough to prevent SQL injection?

or are there more steps I can/should take to prevent anyone from using SQL injection to drop tables or read data from the DB? I also use hash() …