pdo基本使用及pdo预处理防sql注入

$dsn = "mysql:host=localhost;dbname=pdo";
$db=new PDO($dsn,'root','root',array(PDO::MYSQL_ATTR_INIT_COMMAND=>'set names utf8'));
$rs = $db->exec("insert into jq_insert(info) values('zhangsan')");  //pdo插入数据
echo $rs;

//pdo读取数据
<pre name="code" class="html">$data = $db->query("select * from jq_insert");
$data ->setFetchMode(PDO::FETCH_ASSOC);
$result = $data->fetchAll();
$json = json_encode($result);
echo $json;

<form action="pdo_curl.php" method="post">
<input type="text" name="name" value=" abc 'or 'a'='a ">
<input type="text" name="pwd" value="123">
<input type="submit"/>
</form>

<?php
header("content-type:text/html;charset=utf-8")<pre name="code" class="html">
$name=$_POST['name'];
$pwd=$_POST['pwd'];
$dsn="mysql:host=localhost;dbname=7xiangmu_youhua";
$db=new PDO($dsn,'root','root');
$stmt = $db->prepare("select * from pdotest where name = ? and pwd = ?");
$exeres = $stmt->execute(array($name, $pwd));
if ($exeres) {
while ($row = $stmt->fetch()) {
print_r($row);
}
}