PHP防止sql注入小技巧之sql预处理原理与实现方法

<?php
header('Content-type:text/html;charset=utf-8');
$mysqli = new mysqli("127.0.0.1","root","root","test");
$mysqli->query('set names utf8');
$insert = $mysqli->prepare("insert admins (title,cookies,sta,lid) values (?,?,?,?)");
$title = "cuijinpeng";
$cookies = "luyaran201314";
$sta = "1";
$lid = 1;
$insert->bind_param("sssi",$title,$cookies,$sta,$lid);
$res = $insert->execute();
if($res){
  echo 1;
}else{
  echo $insert->error;
  echo 0;
}
$insert->close();
$mysqli->close();

<?php
header('Content-type:text/html;charset=utf-8');
$mysqli = new mysqli("127.0.0.1","root","root","test");
$mysqli->query('set names utf8');
$select = $mysqli->prepare("select id,title,cookies,sta,lid from admins where id > ?");
$id = "1";
$select->bind_param("i",$id);
$select->bind_result($id,$title,$cookies,$sta,$lid);
$select->execute();
while ($select->fetch()) {
  echo $id."---".$title."---".$cookies."---".$sta."---".$lid."<br>";
}
$select->close();
$mysqli->close();