web安全 之 sql注入防御

$mysqli=new MySQLi("localhost","root","","mraz");
if($mysqli->connect_error){
die($mysqli->connect_error);
}
//创建预编译对象
$sql="select id,fdName,fdAge from emp where id=? and fdAge=?";
$mysqli_stmt=$mysqli->prepare($sql);

$id=1;
$fdAge=1;
//绑定参数，严格按照顺序
//ii是两个整型类型，si是一个字符串类型，一个整型类型
$mysqli_stmt->bind_param("ii",$id,$fdAge);
//绑定结果集
$mysqli_stmt->bind_result($id,$fdName,$fdAge);
//执行
$mysqli_stmt->execute();
//取出绑定的值
while($mysqli_stmt->fetch()){
echo "<br/>$id--$fdName--$fdAge";
}

$id=addslashes($_GET[‘id’]);