使用pdo_mysql替代mysql

錯誤的寫法，通過字元串連結拼接sql語句極容易出現注入漏洞

$sql = "select * from table where id=".$id;
$sql = "select * from table where id='".$id."'";
$sql = "INSERT INTO fruit(name, colour) VALUES ('".$name."', '".$colour."')";
		

正確的寫法

$sql = "select * from table where id=?";
$sql = "INSERT INTO fruit(name, colour) VALUES (?, ?)";
		

		
$sql = <<<____SQL
     CREATE TABLE IF NOT EXISTS `ticket_hist` (
       `tid` int(11) NOT NULL,
       `trqform` varchar(40) NOT NULL,
       `trsform` varchar(40) NOT NULL,
       `tgen` datetime NOT NULL,
       `tterm` datetime,
       `tstatus` tinyint(1) NOT NULL
     ) ENGINE=ARCHIVE COMMENT='ticket archive';
____SQL;
		
		

			
Array
(
    [0] => banana
    [1] => yellow
)

Array
(
    [NAME] => banana
    [COLOUR] => yellow
)
			
			

Object
(
	Obj->NAME
	Obj->COLOUR
)
			

print($row[name])
print($row->name)
			

print($row[0])
			

$sql = "select * from tab where status=0 limit 1";
			

$sql = "select id, name, created from tab where id != 100";
			

EXPLAIN select * from members where id != '1010';			索引失效
EXPLAIN select count(*) from members where id != '1010';	索引有效
			

$sql = "select id, name, created from tab where created=now()";