pdo基本使用及pdo预处理防sql注入

来源：互联网发布：赤月传说2神翼数据编辑：程序博客网时间：2024/05/16 04:38

$dsn = "mysql:host=localhost;dbname=pdo";$db=new PDO($dsn,'root','root',array(PDO::MYSQL_ATTR_INIT_COMMAND=>'set names utf8'));$rs = $db->exec("insert into jq_insert(info) values('zhangsan')");  //pdo插入数据echo $rs;//pdo读取数据<pre name="code" class="html">$data = $db->query("select * from jq_insert");$data ->setFetchMode(PDO::FETCH_ASSOC);$result = $data->fetchAll();$json = json_encode($result);echo $json;

pdo预处理防sql注入

<form action="pdo_curl.php" method="post">    <input type="text" name="name" value=" abc 'or 'a'='a ">    <input type="text" name="pwd" value="123">    <input type="submit"/></form>

pdo_curl.php

<?phpheader("content-type:text/html;charset=utf-8")<pre name="code" class="html">$name=$_POST['name'];$pwd=$_POST['pwd'];$dsn="mysql:host=localhost;dbname=7xiangmu_youhua";$db=new PDO($dsn,'root','root');$stmt = $db->prepare("select * from pdotest where name = ? and pwd = ?");$exeres = $stmt->execute(array($name, $pwd));if ($exeres) {    while ($row = $stmt->fetch()) {        print_r($row);    }}

1 0