php 加固mysql

// 不安全的查询方式
$query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "' AND password = '" . $_POST['password'] . "'";

// 安全的查询方式
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $_POST['username']);
$stmt->bindParam(':password', $_POST['password']);
$stmt->execute();

// 加密存储敏感数据
$encrypted_password = password_hash($_POST['password'], PASSWORD_DEFAULT);
$query = "INSERT INTO users (username, password) VALUES (:username, :password)";
$stmt = $pdo->prepare($query);
$stmt->bindParam(':username', $_POST['username']);
$stmt->bindParam(':password', $encrypted_password);
$stmt->execute();

try {
    $pdo = new PDO('mysql:host=localhost;dbname=test', $user, $pass);
    // 执行数据库操作
} catch (PDOException $e) {
    echo "数据库连接失败: " . $e->getMessage();
} finally {
    $pdo = null;
}