相对于sql注入的安全性是否合理？

<?php
require_once(\'db.inc\');
$firstname = $_POST[\'firstname\']; 
$lastname = $_POST[\'lastname\'];
$rsvp = $_POST[\'rsvp\'];
$mail = $_POST[\'email\'];
$phone = $_POST[\'phone\'];
$lodging = $_POST[\'lodging\'];
$extra = $_POST[\'extra\'];
$msg = $_POST[\'msg\'];
$password = $_POST[\'password\'];
$id = $_POST[\'id\'];
$username = $firstname . \' \' . $lastname;

if (isset($id)) {
  $sql = $conn->query(\"UPDATE guest SET username = ?, mail = ?, phone = ?, lodging = ?, extra = ?, msg = ?, role = ?, password = ?, mailed = ? WHERE id = ?\", array($username, $mail, $phone, $lodging,$extra, $msg, 2, $password, 0, $id)); //TODO!! set mailed to 1 in production
  } else {
  $sql = $conn->query(\'INSERT INTO guest (username, password, rsvpstatus, role, mail, phone, lodging, extra, msg, mailed)VALUES (?,?,?,?,?,?,?,?)\', array($username, $password, $rsvp,  2, $mail, $phone, $lodging, $extra, $msg, 1));
  }

 header(\'location:main.php\');