Is there still an injection risk when using prepared statements and mysqli_stmt_bind_param?

For example:

$malicious_input = 'bob"; drop table users'; mysqli_stmt_bind_param($stmt, 's', $malicious_input);

Behind the scenes does mysqli_stmt_bind_param pass this query string to mysql:

SET @username = "bob"; drop table users";

Or does it perform the SET command through the API, or use some type of protection to keep this from happening?