PDO — Prepared Statement gegen SQL-Injection

<?php

declare(strict_types=1);

$pdo = new PDO(
    'mysql:host=127.0.0.1;dbname=programmierung;charset=utf8mb4',
    'root',
    '',
    [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES   => false,
    ]
);

// Named Parameters
$stmt = $pdo->prepare('SELECT id, name FROM languages WHERE is_published = :pub AND category = :cat');
$stmt->execute([':pub' => 1, ':cat' => 'web']);

foreach ($stmt->fetchAll() as $row) {
    echo "{$row['id']}: {$row['name']}\n";
}

// Insert
$stmt = $pdo->prepare('INSERT INTO logs (level, message, created_at) VALUES (?, ?, NOW())');
$stmt->execute(['info', 'System gestartet']);
$id = (int) $pdo->lastInsertId();