PHP 中提供了三種訪問 MySQL 資料庫的擴充套件，即 mysql，mysqli 和 PDO。它們的區別可以比較如下：

上面所說的預處理語句就是用於引數化查詢的。可以看到，除了舊的 mysql 擴充套件不支援，mysqli 和 PDO 這兩個新擴充套件都支援引數化查詢。PDO 擴充套件相比 mysqli 擴充套件的好處是，它是與關係資料庫型別無關的，因此很方便切換資料庫，比如從 MySQL 切換到 PostgreSQL。

首先我們來看看利用 mysqli 擴充套件如何使用引數化查詢。例如：

$mysqli = new mysqli("localhost","dbusername", "dbpassword", "database");
 
$username= "somename";
$password= "someword";
 
$query = "SELECT filename, filesize FROM users WHERE (name = ?) and (password = ?)";
 
$stmt = $mysqli->stmt_init();
 
if ($stmt->prepare($query)) {
    $stmt->bind_param("ss",$username, $password);
    $stmt->execute();
 
    $stmt->bind_result($filename,$filesize);
    while($stmt->fetch()) {
        printf ("%s : %d\n",$filename, $filesize);
    }
    $stmt->close();
}
 
$mysqli->close();
 

再看看用 PDO 擴充套件如何使用引數化查詢。例如：

$pdo = new PDO("mysql:host=localhost;dbname=database","dbusername", "dbpassword");
 
$username= "somename";
$password= "someword";
 
$query = "SELECT * FROM users WHERE (name = :username) and (password = :password)";
 
$statement= $pdo->prepare($query,array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
$statement->bindParam(":username",$username, PDO::PARAM_STR, 10);
$statement->bindParam(":password",$password, PDO::PARAM_STR, 12);
$statement->execute();
 
while ($row = $statement->fetch(PDO::FETCH_ASSOC)) {
  printf ("%s : %d\n",$row["filename"],$row["filesize"]);
}
$statement->closeCursor();
 
$pdo = null;