Update canon.md

Are PDO prepared statements sufficient to prevent SQL injection?