mysql过滤特殊字符语句

SELECT * FROM users WHERE username = 'admin' AND password = '1234';

password = '1234'; DROP TABLE users;

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);

// 检查连接
if ($conn->connect_error) {
    die("连接失败: " . $conn->connect_error);
}

// 预处理语句
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);

// 设置参数并执行
$username = "admin";
$password = "1234";
$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    echo "ID: " . $row["id"]. " - Name: " . $row["username"]. "<br>";
}

$stmt->close();
$conn->close();
?>

<?php
$username = "admin";
$password = "1234'; DROP TABLE users;";

$username = mysqli_real_escape_string($conn, $username);
$password = mysqli_real_escape_string($conn, $password);

$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);

while ($row = mysqli_fetch_assoc($result)) {
    echo "ID: " . $row["id"]. " - Name: " . $row["username"]. "<br>";
}

mysqli_close($conn);
?>