所以这是我的代码：

public static function Add($catName,$catDescr = "",$catImgURL = "",$catSubLevel = 0,$catSubID = 0)
{

    try
    {
        include_once "db_config.PHP";
        $DBH = new PDO("MysqL:host=$db_host;dbname=$db_name",$db_user,$db_pass);
        $DBH->setAttribute( PDO::ATTR_ERRMODE,PDO::ERRMODE_WARNING );  
        $STH = $DBH->prepare("INSERT INTO cat (catName,catDescr,catImg,catSubLevel,catSubID)
                              VALUES ('$catName','$catDescr','$catImgURL',$catSubLevel,$catSubID)");

        $STH->execute();
    }
    catch (PDOException $e)
    {
        echo $e->getMessage();
    }
}

所以一切正常并且看似安全,但是当我做这样的事情时：

Cat::Add("Test Cat","' OR 1==1 --");

它给了我

Warning: PDOStatement::execute()
[pdostatement.execute]:
sqlSTATE[42000]: Syntax error or
access violation: 1064 You have an
error in your sql Syntax; check the
manual that corresponds to your MysqL
server version for the right Syntax to
use near ‘==1 –‘,”,0)’ at line
2 in www\mCat.PHP on line
25

我想这是因为我添加了$DBH-> setAttribute(PDO :: ATTR_ERRMODE,PDO :: ERRMODE_WARNING);为了看我什么时候有错误.

无论如何,主要的问题是 – 这种方法是否可以安全地从sql注入？