bindParam()方法绑定参数

<?php
header('content-type:text/html;charset=utf-8');
try{
    /************---bindParam绑定参数 -- 当使用多sql 语句的时候可以用************/
//    $name=" 'or 1=1 #";
    $name="张三";
    $pwd='123';
    $pdo=new PDO('mysql:host=localhost;dbname=test','root','root');
    $pdo->exec('set names utf8');
//    $stmt=$pdo->prepare("select * from email_user where name='$name' and pwd='$pwd'");  //占位符号 ？
    $stmt=$pdo->prepare("select * from email_user where name=? and pwd=?");  //占位符号 ？
    $stmt->bindParam(1,$name);
    $stmt->bindParam(2,$pwd);
    $stmt->execute();
    echo $stmt->rowCount();

    /*
     **** 数据库添加
    //准备一条语句,并放到服务器端,而且编译
//    绑定参数(变量和参数绑定)
    $stmt=$pdo->prepare("insert into shop(name,pwd)values(:na,:pr)");
    $stmt->bindParam(":na",$name);
    $stmt->bindParam(":pr",$pwd);
    if($stmt->execute()){
        echo "执行成功";
        echo "最后插入的ID:".$pdo->lastInsertId();
    }else{
        echo "执行失败";
    }
    */


    /***************数组的方式***************/
    /*
    $stmt=$pdo->prepare("select * from email_user where name=:name and pwd=:pwd");
    $stmt->execute(array(':name'=>$name,':pwd'=>$pwd));
    $row=$stmt->fetchAll(PDO::FETCH_ASSOC);
    print_r($row);
    echo "<hr/>",$stmt->rowCount();
    $pdo = null;
    */
}catch(PDOException $e){
    echo $e->getMessage();
}




?>