使用PDO查询mysql防止SQL注入

demo文件

<?php
require_once 'config.inc.php';
$dbh = new PDO(DB_DSN, DB_USER, DB_PWD);  

$dbh->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); //禁用prepared statements的仿真效果  
$dbh->exec("set names 'utf8'");   
$sql="select * from location where id = ? ";  
$query = $dbh->prepare($sql);   
$exeres = $query->execute(array(3));   
if ($exeres) {   
    while ($row = $query