怎样防止mysql的注入

$conn = new mysqli($servername, $username, $password, $dbname);

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);

$username = $_POST['username'];
$password = $_POST['password'];

$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // 处理结果
}

$stmt->close();
$conn->close();

use App\Models\User;

$user = User::where('username', $username)->where('password', $password)->first();

if ($user) {
    // 处理用户登录
}

$username = $_POST['username'];
$password = $_POST['password'];

// 验证输入
if (!preg_match('/^[a-zA-Z0-9_]+$/', $username)) {
    die("Invalid username");
}

// 连接数据库并执行查询
$conn = new mysqli($servername, $username, $password, $dbname);
// ...