如何制作一个避免注入的SQLite查询？

Question

I am attempting to check that myusername and mypassword are in the database and if they are print the results. I cannot get the results to be returned and displayed if they match what is in the database, can someone assist please?

// username and password sent from form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

//echo $myusername;
//echo $mypassword;

$stmt  = $db->prepare('SELECT * FROM ADMIN_LOGIN WHERE USERNAME = $myusername AND PASSWORD = $mypassword');
//var_dump($stmt->readOnly()); // -> true

Answer 1

Rework the code as:

$result = $db->query("SELECT * FROM ADMIN_LOGIN WHERE USERNAME = '$myusername' AND PASSWORD = '$mypassword'");

while ($row = $result->fetchArray()) {
    print $row["USERNAME"] . "
";
    print $row["PASSWORD"] . "
";
}