如何在PHP中阻止SQL注入？

$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->bindParam(':email', $email);
$email = $_POST['email'];
$stmt->execute();

$mysqli = new mysqli('localhost', 'username', 'password', 'mydatabase');
$stmt = $mysqli->prepare('SELECT * FROM users WHERE email = ?');
$stmt->bind_param('s', $email);
$email = $_POST['email'];
$stmt->execute();

$email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_STRING);

$email = $mysqli->real_escape_string($_POST['email']);

if (preg_match('/^[a-zA-Z0-9\.\-\_\@]+$/', $_POST['email'])) {
    // 允许执行查询
} else {
    // 拒绝执行查询
}