Not really. The function `query` uses another function from the standard library namely `prepare` that prevents SQL injection attacks by *eliminating the need to manually quote the parameters* as the [documentation][1] suggests.

The idea is fairly simple, but first, let's see what a *prepared statement* means.

As this [article][2] suggests, 

> Prepared statements, also known as parameterized statements or
> parameterized SQL, can be thought of as a template for SQL statements.
> Prepared statements allow database engines to run SQL statements more
> efficiently because the same (or similar) SQL is used over and over
> again. The key feature of
> a prepared statement is the fact that values can be plugged into the
> query after the query is “prepared”, and ready to be executed.


 If you look at the code for `query` *(I replaced the irrelevant parts with comments for the sake of shortness)*

    function query(/* $sql [, ... ] */)
    {
        // SQL statement
        $sql = func_get_arg(0);

        // parameters, if any
        $parameters = array_slice(func_get_args(), 1);

        // try to connect to database [removed]

        // prepare SQL statement
        $statement = $handle->prepare($sql);
        // some code [removed]

        // execute SQL statement
        $results = $statement->execute($parameters);

        // return result set's rows, if any [removed]
    }

You'll find 4 main parts here

 1. storing the SQL statement into `$sql`
 2. storing the parameters into `$parameters`
 3. preparing the statement
 4. passing the parameters and executing the statement

This denotes that the process of *sending* a statement to the server to *prepare* is separate from the process of *executing* this statement. 

And that's exactly the idea behind prepared statements being effective against SQL injection attacks because injection attacks mainly depend on inserting the data inputted by the user into the SQL statement. 

When using prepared statements, the data is sent to the server *after* the statement is sent. This means that the data is never interpreted as SQL.

  [1]: http://php.net/manual/en/pdo.prepare.php
  [2]: http://www.programmerinterview.com/index.php/database-sql/example-of-prepared-statements-and-sql-injection-prevention/