阅读SQL注入攻击后,我正在编辑我的搜索脚本.我试图使用PDO而不是常规的mysql连接从我的脚本中获得相同的功能.所以我一直在阅读有关PDO的其他帖子,但不确定.这两个脚本会给出相同的功能吗?
使用PDO:
$pdo = new PDO('mysql:host=$host; dbname=$database;', $user, $pass);
$stmt = $pdo->prepare('SELECT * FROM auction WHERE name = :name');
$stmt->bindParam(':name', $_GET['searchdivebay']);
$stmt->execute(array(':name' => $name);
与常规mysql:
$dbhost = @mysql_connect($host, $user, $pass) or die('Unable to connect to server');
@mysql_select_db('divebay') or die('Unable to select database');
$search = $_GET['searchdivebay'];
$query = trim($search);
$sql = "SELECT * FROM auction WHERE name LIKE '%" . $query . "%'";
if(!isset($query)){
echo 'Your search was invalid';
exit;
} //line 18
$result = mysql_query($trim);
$numrows = mysql_num_rows($result);
mysql_close($dbhost);
我继续使用正规的例子
while($i < $numrows){
$row = mysql_fetch_array($result);
从数据库创建一个匹配结果的数组.如何使用PDO?