写成这样SQL injection 应该没问题吧？ [ 新手入门 ]

if (isset($_GET['author'])){
  $authorName = trim($_GET['author']);
  $criteria->condition .= ' and author_name =:map_author ';
  $criteria->params[':map_author'] = $authorName;    
}