转换为mysql准备语句

Question

我想研究如何准备语句在MySQL中工作，我被告知，我使用的所有代码都容易受到MySQL注入，我使用codeigniter php模型来编写这样的mysql查询代码例如。

public function getOpenLoans($id){ 
      $query = 'select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment 
         from useropenloan a 
         where a.Owner = ' .$id. ' and UPDATE_DT is null' ; 

      $query = $this->db->query($query); 
      $result = $query->result(); 
      return $result; 
     } 

这基本上得到一排的一些信息，但是我真正想知道的是如何 其转换为准备MySQL的说法，我想下面的计算器不同的方法和一些YouTube的教程，但他们不工作，所以有人可以帮助我在准备好的sql语句中编写这段代码。

我尝试了这种方式

$stmt = $conn->prepare(select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment 
          from useropenloan a 
          where a.Owner = :id and UPDATE_DT is null); 
$stmt->bindParam(':id', $id); 
$stmt->execute(); 

Answer 1

public function getOpenLoans($id){ 
    $sql = "select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment from useropenloan a where a.Owner = ? and UPDATE_DT is null"; 
    $query = $this->db->query($sql, array($id)); 
    $result - $query->result(); 
    return $result; 
}