mysql语句防止攻击_php – 在MySQL中使用预处理语句是否可以防止SQL注入攻击？

我只想验证在

MySQL中使用预处理语句是否会阻止SQL注入.

以下代码是否会阻止所有SQL注入攻击？

$var = $_GET['q'];

$trimmed = trim($var);

if ($trimmed != NULL) {

$get_fighters = $DBH->prepare(

'SELECT *

FROM fighters

WHERE name LIKE :searchTerm

OR nickname LIKE :searchTerm

OR born_in_city LIKE :searchTerm

OR born_in_state LIKE :searchTerm

OR born_in_country LIKE :searchTerm

ORDER BY name ASC');

$get_fighters->bindValue(':searchTerm', '%' . $trimmed . '%', PDO::PARAM_STR);

$get_fighters->setFetchMode(PDO::FETCH_ASSOC);

$get_fighters->execute();

$check_results_fighters = $get_fighters->rowCount();

$get_events = $DBH->prepare(

'SELECT *

FROM events

WHERE event_name LIKE :searchTerm

OR event_arena LIKE :searchTerm

OR event_city LIKE :searchTerm

OR event_state LIKE :searchTerm

OR event_country LIKE :searchTerm

OR organization LIKE :searchTerm

ORDER BY event_date DESC');

$get_events->bindValue(':searchTerm', '%' . $trimmed . '%', PDO::PARAM_STR);

$get_events->setFetchMode(PDO::FETCH_ASSOC);

$get_events->execute();

$check_results_events = $get_events->rowCount();

}