Secure SQL query

$country_code = 'AFG';
if($stmt = $db->prepare("SELECT Name, Population FROM city WHERE CountryCode = ?")){
    $stmt->bind_param('s', $country_code);
    $stmt->execute();
    $stmt->bind_result($name, $population);
    while ($stmt->fetch()){
        echo "Name: {$name}; Population: {$population}<br>";
    }