php中prerare如何运用

public PDO::prepare(string $statement, array $driver_options = array()): PDOStatement为 PDOStatement::execute() 方法准备待执行的 SQL 语句。 语句模板可以包含零个或多个参数占位标记，格式是命名（:name）或问号（?）的形式，当它执行时将用真实数据取代。 在同一个语句模板里，命名形式和问号形式不能同时使用；只能选择其中一种参数形式。 请用参数形式绑定用户输入的数据，不要直接字符串拼接到查询里。

注意: The parser used for emulated prepared statements and for rewriting named or question mark style parameters supports the non standard backslash escapes for single- and double quotes. That means that terminating quotes immediately preceeded by a backslash are not recognized as such, which may result in wrong detection of parameters causing the prepared statement to fail when it is executed. A work-around is to not use emulated prepares for such SQL queries, and to avoid rewriting of parameters by using a parameter style which is natively supported by the driver.

<?php

/* 传入数组的值，并执行准备好的语句 */

$sql = SELECT name, colour, calories

FROM fruit

WHERE calories < :calories AND colour = :colour;

$sth = $dbh->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));

$sth->execute(array(:calories => 150, :colour => red));

$red = $sth->fetchAll();

$sth->execute(array(:calories => 175, :colour => yellow));

$yellow = $sth->fetchAll();

?>

<?php

/* 传入数组的值，并执行准备好的语句 */

$sth = $dbh->prepare(SELECT name, colour, calories

FROM fruit

WHERE calories < ? AND colour = ?);

$sth->execute(array(150, red));

$red = $sth->fetchAll();

$sth->execute(array(175, yellow));

$yellow = $sth->fetchAll();

?>