PHP防止SQL注入

<?php
$mysql=new MySQLi("localhost","root","","test02");




$username="zbx";
$password="admin";


if($mysql){
echo "数据库连接成功!";
}else{
echo "数据库连接失败";
}


$stmt=$mysql->prepare("select * from tb_user where username=? and password=?");


$stmt->bind_param("ss",$username,$password);


$stmt->execute();






if($stmt->num_rows > 0){
echo "登录成功!";
}else{
echo "登录失败!";
}
?>