向DB插入数据的好方法[重复]

Question

This question already has an answer here:

• How can I prevent SQL injection in PHP? 28 answers

$query  = $this->db->prepare("INSERT INTO `images` (`anunt`, `image_location`) VALUES(?, ?)");

        $query->bindValue(1, $iddd);
        $query->bindValue(2, $image_location);


        try{
        $query->execute();

or this

$ret = sql_query("INSERT INTO images (anunt, image_location) VALUES ('" .$iddd. "', '" .$image_location. "')");

Or another way maybe? What advantages are with the bind one? I read something that it's hard to sql inject.

</div>

Answer 1

Databse pre-optimzations

When you initialize a prepared statement, the DBMS actually pre-optimizes the database and compiles your query. This would be useful if you plan to make multiple bound queries with the same prepared statement.

SQL Injection prevention

The PHP SQL drivers will escape any literals inside a bound value, to prevent SQL injection.