sql注入及防止SQL注入

<?php
header('content-type:text/html;charset=utf-8');
$dsn = "mysql:host=127.0.0.1;dbname=username";
$db = new PDO($dsn,'root','');
$username=shiyan;
$pwd=000;
//未设置预处理之前
$sel="select * from user where username='$username' and pwd='$pwd'";
$count=$db->query($sel);
$arrs = $count->fetchAll();
print_r($arrs);

//进行预处理之后
$sql="select * from user where username = ? and pwd = ?";
$stmt = $db->prepare($sql);
$exeres = $stmt->execute(array($username, $pwd));
if ($exeres) {
 while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
     print_r($row);
 }
}
?>