防止SQL注入的若干笔记

利用 mysqli

$mysqli = new mysqli('localhost', 'my_user', 'my_password', 'world');$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");$code = 'DEU';$language = 'Bavarian';$official = "F";$percent = 11.2;$stmt->bind_param('sssd', $code, $language, $official, $percent);