$conn = mysql_connect('localhost', 'root', 'root');
mysql_select_db('test');
mysql_query("SET NAMES 'utf8'");
$name = mysql_real_escape_string('harry');
$result = mysql_query("SELECT * FROM user WHERE name='$name'");
while ($row = mysql_fetch_assoc($result)) {
echo "Name: {$row['name']} Age: {$row['age']}\n";
}
$pdo = new PDO("mysql:host=localhost;dbname=test", 'root', 'root');
$pdo->exec("SET NAMES 'utf8'");
$stmt = $pdo->prepare("SELECT * FROM user WHERE name = ?");
$stmt->execute(array('harry'));
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
echo "Name: {$row['name']} Age: {$row['age']}\n";
}
$pdo = null;
PDO 使用預處理語句自動處理跳脫,有效防止 SQL 注入,且支援多種資料庫驅動,程式碼可攜性高。