php 入库过滤

<?php
// 数据库连接
$host = 'localhost';
$dbname = 'testdb';
$user = 'username';
$pass = 'password';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8", $user, $pass);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // 用户输入
    $username = $_POST['username'];
    $email = $_POST['email'];

    // 输入验证和清洗
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        throw new Exception("Invalid email format");
    }

    $username = htmlspecialchars($username, ENT_QUOTES);
    $email = htmlspecialchars($email, ENT_QUOTES);

    // 插入数据库
    $stmt = $pdo->prepare("INSERT INTO users (username, email) VALUES (:username, :email)");
    $stmt->bindParam(':username', $username);
    $stmt->bindParam(':email', $email);
    $stmt->execute();

    echo "Data inserted successfully!";
} catch (Exception $e) {
    echo "Error: " . $e->getMessage();
}
?>