pdo基本使用及pdo预处理防sql注入

    $dsn = "mysql:host=localhost;dbname=pdo";  
    $db=new PDO($dsn,'root','root',array(PDO::MYSQL_ATTR_INIT_COMMAND=>'set names utf8'));  
    $rs = $db->exec("insert into jq_insert(info) values('zhangsan')");  //pdo插入数据  
    echo $rs;  
      
    //pdo读取数据  
    <pre name="code" class="html">$data = $db->query("select * from jq_insert");  
    $data ->setFetchMode(PDO::FETCH_ASSOC);  
    $result = $data->fetchAll();  
    $json = json_encode($result);  
    echo $json;  

pdo预处理防sql注入

login.php

    <form action="pdo_curl.php" method="post">  
        <input type="text" name="name" value=" abc 'or 'a'='a ">  
        <input type="text" name="pwd" value="123">  
        <input type="submit"/>  
    </form>  

pdo_curl.php

    <?php  
    header("content-type:text/html;charset=utf-8")<pre name="code" class="html">  
    $name=$_POST['name'];  
    $pwd=$_POST['pwd'];  
    $dsn="mysql:host=localhost;dbname=7xiangmu_youhua";  
    $db=new PDO($dsn,'root','root');  
    $stmt = $db->prepare("select * from pdotest where name = ? and pwd = ?");  
    $exeres = $stmt->execute(array($name, $pwd));  
    if ($exeres) {  
        while ($row = $stmt->fetch()) {  
            print_r($row);  
        }  
    }