php和mysql数据库防SQL注入的有效解决办法

<?php

$mysqli = new mysqli("localhost", "my_user", "my_password", "world");

/* check connection */

if (mysqli_connect_errno()) {

printf("Connect failed: %s\n", mysqli_connect_error());

exit();

}

$city = "Amersfoort";

/* create a prepared statement */

if ($stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {

/* bind parameters for markers */

$stmt->bind_param("s", $city);

/* execute query */

$stmt->execute();

/* bind result variables */

$stmt->bind_result($district);

/* fetch value */

$stmt->fetch();

printf("%s is in district %s\n", $city, $district);

/* close statement */

$stmt->close();

}

/* close connection */

$mysqli->close();

?>