防止sql注入

<?php
$mysql = new mysqli("localhost","root","","mysql_interface");
if(mysqli_connect_errno()){
echo "连接数据库失败：".mysqli_connect_error();
$mysqli=null;
exit;
}
$username = $_POST['username'];
$password = $_POST['password'];

/*
*防止sql注入
*ss 规定不能使用除了字符串之外的任何数据类型
*/
$stmt = $mysql->prepare("select * from user where username =? and password=?");
$stmt->bind_param("ss",$username,$password);
$stmt->execute();
$result = $stmt->get_result();
/*
*以下代码能够被sql注入
*/
/*
$sql = "select * from user where username = '$username' and password = '$password'";
$result = $mysql->query($sql);
if (!$result) {
echo "sql语句错误<br>";
echo "error:".$mysql->error."|".$mysql->error;
exit;
}*/

if ($result->num_rows > 0) {
echo "登陆成功";
}else{
echo "登陆失败";
}
?>