php - 将参数添加到 PHP mssql 查询

Question

给定以下查询(在代码中，不是存储过程)；如何向查询添加参数而不是直接在查询中包含条件值？换句话说:我怎样才能使这个数据库调用安全？

$dbhandle = mssql_connect($myServer, $myUser, $myPass); 
$selected = mssql_select_db($myDB, $dbhandle); 

$query  = "SELECT lastname, firstname, address, phone, email ";
$query .= "  FROM person";
$query .= " WHERE lastname LIKE '" . $lastName . "'";

$result = mssql_query($query);

while($row = mssql_fetch_array($result)) {
... etc.

Answer 1

使用 PDO 使其安全

http://php.net/manual/en/book.pdo.php