Bind variables in a mysql_query statement

问题

Example mysql_query:

$query=mysql_query("SELECT `col1`, `col2` FROM `table` WHERE
`col1`='$escapedvariable' ");

I know the above is not good in practice.

Better query using prepare and execute

$pSt = $dbh->prepare('SELECT col1, col2 FROM table WHERE col1=:col1);

$pSt->execute(array(':col1'=>$escapedvariable);

$status=$pSt->errorCode();

Question: Can I use mysql_query with bound variables for added security?

回答1:

No, you have to use mysqli-functions or PDO.

来源：https://stackoverflow.com/questions/4836821/bind-variables-in-a-mysql-query-statement