mysqli预处理技术

<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = new mysqli($servername, $username, $password, $dbname);

// 检查连接
if ($conn->connect_error) {
    die("连接失败: " . $conn->connect_error);
}

// 准备 SQL 语句
$stmt = $conn->prepare("SELECT id, firstname, lastname FROM MyGuests WHERE firstname = ?");
if (!$stmt) {
    die("准备语句失败: " . $conn->error);
}

// 绑定参数
$firstname = "John";
$stmt->bind_param("s", $firstname);

// 执行查询
$stmt->execute();

// 绑定结果变量
$stmt->bind_result($id, $firstname, $lastname);

// 获取结果
while ($stmt->fetch()) {
    echo "id: " . $id . " - Name: " . $firstname . " " . $lastname . "<br>";
}

// 关闭语句
$stmt->close();

// 关闭连接
$conn->close();
?>