如何防止PHP表单中的SQL注入攻击？

// 连接数据库
$dsn = 'mysql:host=localhost;dbname=test';
$username = 'root';
$password = 'password';

try {
    $pdo = new PDO($dsn, $username, $password);
    // 设置错误模式为异常
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
    echo '数据库连接失败：' . $e->getMessage();
}

// 准备SQL语句
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// 绑定参数
$stmt->bindParam(':username', $username);

// 执行查询
$stmt->execute();

// 获取结果
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);

// 输出结果
foreach($result as $row) {
    echo $row['username'];
}

// 连接数据库
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "test";

$conn = mysqli_connect($servername, $username, $password, $dbname);
// 检查连接是否成功
if (!$conn) {
    die("数据库连接失败: " . mysqli_connect_error());
}

// 过滤用户输入数据
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

// 执行查询
$sql = "SELECT * FROM users WHERE username = '{$username}' AND password = '{$password}'";
$result = mysqli_query($conn, $sql);

// 处理结果
if (mysqli_num_rows($result) > 0) {
    while($row = mysqli_fetch_assoc($result)) {
        echo "用户名为： " . $row["username"];
    }
} else {
    echo "用户名或密码错误";
}

// 关闭连接
mysqli_close($conn);