[PDO]①0--quote()方法防止SQL注入

test.php

<


    
    
    
    



    用户名:

    密码:

    

doAction.php

quote($username);
    //通过quote() 返回带引号的字符串 过滤字符串中的特殊字符
    //防止Sql注入
    $sql = "select * from user where username={$username} and password='{$password}'";
    //select * from user where username='\'or 1=1 \'' and password='king2'
    //echo $sql;

    $stmt = $pdo->query($sql);
    echo $stmt->rowCount();//0 1...对于select 返回结果集中记录的条数
    //对于INSERT UPDATE DELETE 返回受影响的记录的条数

} catch (PDOException $e) {
    echo $e->getMessage();
}

?>

Paste_Image.png

Paste_Image.png