php安全-防止sql注入攻击简单方法_PHP教程

$sql="select password from users where username='$name'";

$res=mysql_query($sql,$conn);

if ($arr=mysql_fetch_assoc($res)){//如果用户名存在

if ($arr['password']==$pwd) {//密码比对

echo "登录成功";

}else{

echo "密码输入有误";

}

}else {

echo "该用户名不存在";

}

$name=$_GET['username'];

$pwd=$_GET['password'];

$sql="select * from users where username=? and password=?";

//1.创建一个pdo对象

$pdo=new PDO("mysql:host=localhost;port=3306;dbname=injection","root","");

//2.设置编码

$pdo->exec("set names 'utf8'");

//3.预处理$sql语句

$pdoStatement=$pdo->prepare($sql);

//4.把接收到的用户名和密码填入

$pdoStatement->execute(array($name,$pwd));

//5.取出结果

$res=$pdoStatement->fetch();

if(empty($res)){

echo "用户名或密码输入有误";

}else{

echo "登录成功";

}