What characters are NOT escaped using the prepared mysqli statement?

I am trying to pin some of my PHP code and use prepared mysqli statements to better verify user input and prevent injection.

I switched from mysqli_real_escape_string since it does not escape% and _ . However, when I create my query as a prepared mysqli statement, the same flaw is still present. The request pulls out the value of the user cell based on their username. I would do something similar for passwords and other searches.

the code:

$db = new sitedatalayer();

if ($stmt = $db->_conn->prepare("SELECT `salt` FROM admins WHERE `username` LIKE ? LIMIT 1")) {

  $stmt->bind_param('s', $username);
  $stmt->execute();
  $stmt->bind_result($salt);


  while ($stmt->fetch()) { 
    printf("%s\n", $salt);
  } 

  $stmt->close();    

}

else return false;

• Am I composing the expression correctly?
• If I, what other characters should be considered? What other disadvantages exist?
• What is best for these types of choices?

Thank,