php安全,防止sql注入攻击简单方法

<?php
$sql = "select password from users where username=&#39;$name&#39;";
$res = mysql_query($sql, $conn);
if ($arr = mysql_fetch_assoc($res)) { //如果用户名存在
    if ($arr[&#39;password&#39;] == $pwd) { //密码比对
        echo "登录成功";
    } else {
        echo "密码输入有误";
    }
} else {
    echo "该用户名不存在";
}
?>

<?php
$name = $_GET[&#39;username&#39;];
$pwd = $_GET[&#39;password&#39;];
$sql = "select * from users where username=? and password=?";
//1.创建一个pdo对象
$pdo = new PDO("mysql:host=localhost;port=3306;dbname=injection", "root", "");
//2.设置编码
$pdo->exec("set names &#39;utf8&#39;");
//3.预处理$sql语句
$pdoStatement = $pdo->prepare($sql);
//4.把接收到的用户名和密码填入
$pdoStatement->execute(array(
    $name,
    $pwd
));
//5.取出结果
$res = $pdoStatement->fetch();
if (emptyempty($res)) {
    echo "用户名或密码输入有误";
} else {
    echo "登录成功";
}
?>