Prepared statements absolutely prevent SQL injection vulnerabilities in statements where they are used, period, paragraph.
Validating or "sanitizing" your input may appear similarly effective, but the unquestioned consensus among experts is that there is no effective alternative for prepared statements, and concatenated queries are simply unacceptable.
There are ways of getting bad data past validation attempts that you have not yet imagined, and likely never will, until your server is exploited. There are, for example, exploits involving alternate character sets, which can sail right through what seems like proper validation or escaping.
But the apparent effectiveness aside, there's also an overriding principle at play: the fundamental and vital aspect of prepared statements that you appear not to be considering is that they impose the correct separation between "code" and "data." (In other environments, a breach of the boundary between code and data is at the heart of "buffer overrun" vulnerabilities.) In SQL, the query is the code, and the values supplied are data. They are different kinds of "things," and should be kept segregated, as a matter of principle.
Prepared statements don't simply substitute the ?
with the values. The query and the values are provided separately to the database server in different data structures. With this mechanism, it becomes literally impossible for the database server to get it wrong and blur the boundary.
An effective illustration of this fact is the fact that you can't use ?
placeholders for database object identifiers, like table or column names, providing the value as an argument. That doesn't work, because it is not supposed to work. Table and column names are part of the code, not part of the data.
"Impossible" to get it wrong is a term that you can't apply to your attempts at input validation.
Usernames are also an overly simplistic example, since they are easily constrained to ascii alpha. Many or most other columns are not. Make a change, later, and "oops," you forgot to handle something. Perhaps it was something inconceivably remote and unlikely, but now it's just waiting to be exploited.
There have also been a number of excellent comments to your question, which you would do well to take into consideration.
Prepared statements are the correct mechanism for handing outside data to a database... but I would argue that experts and professionals don't even ask themselves whether the data source is trustworthy or not -- we use placeholders and prepared statements consistently and unconditionally, without regard to the origin of the data we're passing.
Of course, it should be obvious that my point is not to downplay protecting against other vulnerabilities, but that is not the role of prepared statements. However effective other mechanisms may appear at assisting with the task, and however useful they may be for their intended purpose, they are not a substitute for proper handling of data on its way to the dbms.