如何從 mysql_real_escape_string() 遷移到 PDO 準備語句？

<code class="php">&lt;?php
// Connect to the database
$db = new PDO('mysql:host=localhost;dbname=test', 'root', 'password');

// Prepare the statement with placeholder for value
$stmt = $db-&gt;prepare('SELECT * FROM users WHERE username = ?');

// Bind the value to the placeholder (already sanitized via other means)
$stmt-&gt;bindParam(1, $username);

// Execute the statement without fear of SQL injection
$stmt-&gt;execute();

// Fetch the results
$users = $stmt-&gt;fetchAll(PDO::FETCH_ASSOC);</code>