我如何使用 pdo prepare 语句实现这一点

Question

在 mysqli 服务器中，我使用下面的代码来选择由 url 代码指定的列：

       include "init.php";

       $get=$_GET["action"];

       $sql = mysqli_query($conn, "SELECT * FROM $get ORDER BY id DESC LIMIT 6");

       $productCount = mysqli_num_rows($sql); // count the output amount

       if ($productCount > 0) 
       {

       while($row = mysqli_fetch_array($sql)){

       $id = $row["id"];

       $jjode = $row["code"];

       $product_name = $row["network"];

       $details = $row["details"];

       $logo = $row["logo"];

       $price = $row["price"];

       }

我尝试在我的 pdo 服务器中使用它，如代码：

       include "init.php";

       $get=$_GET["action"];

       $sql = $conn->prepare("SELECT id,code,network,details,logo,price FROM $get ORDER BY id DESC LIMIT 6");

       $sql->execute();

       $row = $sql->fetchAll();
        if(count($row) > 0)

       {

       $id = $row["id"];

       $jjode = $row["code"];

       $product_name = $row["network"];

       $details = $row["details"];

       $logo = $row["logo"];

       $price = $row["price"];

       }

但它没有输出更好的结果，请我如何使用 pdo 实现这一点，请提前感谢

Answer 1

两个代码清单都不安全。 对 $get 使用白名单。

你应该循环 fetchAll 的结果

$rows = $sql->fetchAll();
foreach ($rows as $row)

{

   $id = $row["id"];

   $jjode = $row["code"];

   $product_name = $row["network"];

   $details = $row["details"];

   $logo = $row["logo"];

   $price = $row["price"];

}