php5防注入

<?php
try {
    // 创建PDO连接
    $pdo = new PDO('mysql:host=localhost;dbname=test', 'username', 'password');
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    // 用户输入
    $username = $_POST['username'];
    $password = $_POST['password'];

    // 预处理语句
    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
    $stmt->bindParam(':username', $username, PDO::PARAM_STR);
    $stmt->bindParam(':password', $password, PDO::PARAM_STR);

    // 执行查询
    $stmt->execute();

    // 获取结果
    $result = $stmt->fetchAll(PDO::FETCH_ASSOC);

    // 处理结果
    if (!empty($result)) {
        echo "登录成功";
    } else {
        echo "用户名或密码错误";
    }
} catch (PDOException $e) {
    echo "数据库连接失败: " . $e->getMessage();
}
?>