防止SQL注入的连接方式

$link = new mysqli($host, $user, $password, $dbName);
if ($link->connect_error) {
    die("连接失败：" . $link->connect_error);
}
$sql = "SELECT uniacid FROM ims_ewei_shop_goods_optimize_member WHERE `status`=1";
$res = $link->query($sql);
$data = $res->fetch_all(1);//1:MYSQLI_ASSOC;2:MYSQL_NUM(默认)
//print_r($data);

$pdo = new PDO("mysql:host=$host;dbname=$dbName", $user, $password);
$status = 1;
$pre = $pdo->prepare('select uniacid FROM ims_ewei_shop_goods_optimize_member WHERE `status`=:status');
$pre->bindParam(':status', $status);
$pre->execute();
$a = $pre->fetchAll(PDO::FETCH_ASSOC);
//print_r($a);
$sql = "select uniacid FROM ims_ewei_shop_goods_optimize_member WHERE `status`=1";
$result = $pdo->query($sql)->fetchAll(PDO::FETCH_NUM);
$string = '149,88,8,1706,2750,2493,1310,1348,3362';
$str = strval(88);
if (strpos($string,$str) !== false)
    echo 'ok!';
else
    echo 'oh,no!';