Using either of them correctly will.

It is very easy to verify that a mysqli or PDO call is correct by looking at it. The same cannot be said for mysql_query.

90% of example code for PDO uses prepared statements. 90% of example code for the mysql_* functions is ancient and full of security holes.