Update canon.md

Are PDO prepared statements sufficient to prevent SQL injection?
Merge pull request #5 from iroegbu/patch-1

Update canon.md