mysql语句的拼接

// 使用预处理语句
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// 缓存拼接好的SQL语句
$sql = "SELECT * FROM users WHERE username = '" . addslashes($username) . "' AND password = '" . addslashes($password) . "'";
$result = $pdo->query($sql);

$sql = "SELECT * FROM users WHERE ";
if (!empty($username)) {
    $sql .= "username = '" . addslashes($username) . "' AND ";
}
if (!empty($password)) {
    $sql .= "password = '" . addslashes($password) . "'";
}
$result = $pdo->query($sql);