I wanted to know if there is any other measures against SQL injection that can be taken apart from using parametrized Query and validating data. Thanks!
With All good answers above, What I did is create a script that scans all tables and creates whitelist for table names and columns then I use that to validate any user input that is supposed to be table/column name since they don't go into parametric query. Anything else is parameterized via PDO Bind!