php安全-防止sql注入攻击简单方法

       $sql="select password from users where username='$name'";

       $res=mysql_query($sql,$conn);

       if ($arr=mysql_fetch_assoc($res)){//如果用户名存在

              if ($arr['password']==$pwd) {//密码比对

                     echo "登录成功";

       }else{

              echo "密码输入有误";

       }

       }else {

              echo "该用户名不存在";

       }

       $name=$_GET['username'];

       $pwd=$_GET['password'];   

       $sql="select * from users where username=? and password=?";

       //1.创建一个pdo对象

       $pdo=new PDO("mysql:host=localhost;port=3306;dbname=injection","root","");

       //2.设置编码

       $pdo->exec("set names 'utf8'");

       //3.预处理$sql语句

       $pdoStatement=$pdo->prepare($sql);

       //4.把接收到的用户名和密码填入

       $pdoStatement->execute(array($name,$pwd));

       //5.取出结果

       $res=$pdoStatement->fetch();

       if(empty($res)){

              echo "用户名或密码输入有误";

       }else{

              echo "登录成功";        

       }