参数化查询的语法示例

PHP与MySQLi

使用PHP和MySQLi进行参数化查询，可以采用预处理语句（prepared statements）的方式：

```php

$servername = "localhost";

$username = "username";

$password = "password";

$dbname = "database_name";

// 创建连接

$conn = new mysqli($servername, $username, $password, $dbname);

// 检查连接

if ($conn->connect_error) {

die("连接失败: " . $conn->connect_error);

}

// SQL语句

$stmt = $conn->prepare("SELECT FROM users WHERE username = ? AND password = ?");

$stmt->bind_param("ss", $username, $password);

// 设置参数

$username = "john_doe";

$password = "john_password";

// 执行预处理语句

$stmt->execute();

// 获取结果

$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {

echo "id: " . $row["id"] . " - Name: " . $row["username"];

}

// 关闭连接

$stmt->close();

$conn->close();

?>

```

Python与SQLite3

在Python中使用SQLite3库进行参数化查询：

```python

import sqlite3

连接到SQLite数据库

conn = sqlite3.connect('example.db')

创建一个Cursor:

cursor = conn.cursor()

执行一条SQL语句，使用?作为占位符，然后通过tuple传递参数

cursor.execute("SELECT FROM users WHERE username = ? AND password = ?", ('john_doe', 'john_password'))

获取所有结果

rows = cursor.fetchall()

for row in rows:

print(f"id: {row[0]} - Name: {row[1]}")

关闭Cursor:

cursor.close()

提交事务:

conn.commit()

关闭Connection:

conn.close()

```

Java与JDBC

在Java中使用JDBC进行参数化查询：

```java

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.PreparedStatement;

import java.sql.ResultSet;

import java.sql.SQLException;

public class ParameterizedQueryExample {

public static void main(String[] args) {

String url = "jdbc:mysql://localhost:3306/database_name";

String user = "username";

String password = "password";

try (Connection conn = DriverManager.getConnection(url, user, password)) {

String sql = "SELECT FROM users WHERE username = ? AND password = ?";

try (PreparedStatement pstmt = conn.prepareStatement(sql)) {

pstmt.setString(1, "john_doe");

pstmt.setString(2, "john_password");

try (ResultSet rs = pstmt.executeQuery()) {

while (rs.next()) {

int id = rs.getInt("id");

String username = rs.getString("username");

System.out.println("id: " + id + " - Name: " + username);

}

}

}

} catch (SQLException e) {

e.printStackTrace();

}

}

}

```

这些示例展示了如何在不同的编程语言和数据库环境中使用参数化查询来防止SQL注入攻击。在实际应用中，应始终遵循安全编码的最佳实践，以确保应用程序的安全性。