mysql_query查询

// 错误的示例代码
$result = mysql_query("SELECT * FROM users");

// 使用 MySQLi 的示例代码
$mysqli = new mysqli("localhost", "username", "password", "database");
$result = $mysqli->query("SELECT * FROM users");

// 使用 PDO 的示例代码
$pdo = new PDO("mysql:host=localhost;dbname=database", "username", "password");
$result = $pdo->query("SELECT * FROM users");

// 潜在的 SQL 注入示例
$username = $_POST['username'];
$password = $_POST['password'];
$result = mysql_query("SELECT * FROM users WHERE username = '$username' AND password = '$password'");

// 使用 MySQLi 的预处理语句示例
$mysqli = new mysqli("localhost", "username", "password", "database");
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$username = $_POST['username'];
$password = $_POST['password'];
$stmt->execute();
$result = $stmt->get_result();