php mysql转义

$mysqli = new mysqli("localhost", "username", "password", "database");
if ($mysqli->connect_error) {
    die("连接失败: " . $mysqli->connect_error);
}

$user_input = "O'Reilly";
$escaped_input = $mysqli->real_escape_string($user_input);

$sql = "SELECT * FROM books WHERE author = '$escaped_input'";
$result = $mysqli->query($sql);

// 处理结果...

$mysqli->close();

try {
    $pdo = new PDO("mysql:host=localhost;dbname=database", "username", "password");
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $user_input = "O'Reilly";
    $stmt = $pdo->prepare("SELECT * FROM books WHERE author = :author");
    $stmt->bindParam(':author', $user_input);
    $stmt->execute();

    // 处理结果...
} catch (PDOException $e) {
    echo "数据库连接失败: " . $e->getMessage();
}

$pdo = null;