Using PDO_Mysql extension in PHP effectively avoids SQL Injection

First, what is SQL injection?
To put it bluntly, when a person accesses your application, he needs to enter some special characters, you didn't filter the input. As a result, his input changes the function of your SQL statement to achieve his own purpose. In this way, he may have a lot of permissions, to launch your own attacks
The above description is not rigorous. If you want to learn more about SQL injection, visit the following link:
 
Http://www.php.net/manual/zh/security.database.sql-injection.php
 
The purpose of this article is not to let everyone know what SQL injection is, but to forget SQL injection.
In practice, there must be a lot of experience to be summarized to avoid SQL injection. In the previous mysql and mysqli extensions, We need to manually process user input data to avoid SQL injection, at this time, you must have a good understanding of SQL injection. Only by understanding it can you take effective measures for specific injection methods.
 
The emergence of PDO_Mysql allows you to get away from the struggle of SQL injection. You just need to remember to set up a suitable charset when creating a pdo_mysql linked instance, you no longer have to worry about SQL injection. It is very important to set the character set correctly. Otherwise, some special characters can be constructed for SQL injection.
 
Mysql: host = localhost; dbname = testdb; charset = utf8
 
Prepare before SQL statement execution
 
Well, it seems that this is so simple that we say goodbye to SQL injection, and it feels a bit illusory.