php - 为什么这个简单的插入语句不起作用(PDO)？

Question

代码很简单——从表单中获取一个值，将其插入到 mysql 数据库中。这是一个片段:

//connect to DB
$dbh = new PDO($db_pdo, $db_user_name, $db_password);

//capture value from form
$first_name = $_POST['first_name'];

//insert value into DB (doesn't work- no new entry created in requests)
$dbh->exec("INSERT INTO requests(first_name) VALUES($first_name)");

//this echo statement works (outputs the value of $first_name):
echo "\$first_name ".$first_name;

//this insert statement works: 
$dbh->exec("INSERT INTO requests(first_name) VALUES('oleg')");

Answer 1

没错，您必须引用您的字符串。

$dbh->exec("INSERT INTO requests(first_name) VALUES('$first_name')");

但是这段代码很容易受到 SQL 注入(inject)攻击。我不确定如何在 PHP 中防止这种情况。