Php安全地从Web表单插入数据到MySql

// 连接到数据库
$dsn = "mysql:host=localhost;dbname=mydatabase";
$username = "username";
$password = "password";
$dbh = new PDO($dsn, $username, $password);

// 准备预处理语句
$stmt = $dbh->prepare("INSERT INTO mytable (column1, column2) VALUES (:value1, :value2)");

// 绑定参数
$stmt->bindParam(':value1', $value1);
$stmt->bindParam(':value2', $value2);

// 设置参数的值
$value1 = $_POST['input1'];
$value2 = $_POST['input2'];

// 执行查询
$stmt->execute();

// 连接到数据库
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "mydatabase";
$conn = new mysqli($servername, $username, $password, $dbname);

// 准备查询语句
$stmt = $conn->prepare("INSERT INTO mytable (column1, column2) VALUES (?, ?)");

// 绑定参数
$stmt->bind_param("ss", $value1, $value2);

// 设置参数的值
$value1 = $_POST['input1'];
$value2 = $_POST['input2'];

// 执行查询
$stmt->execute();