轉換爲mysql準備語句

Question

我想研究如何準備語句在MySQL中工作，我被告知，我使用的所有代碼都容易受到MySQL注入，我使用codeigniter php模型來編寫這樣的mysql查詢代碼例如。

public function getOpenLoans($id){ 
      $query = 'select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment 
         from useropenloan a 
         where a.Owner = ' .$id. ' and UPDATE_DT is null' ; 

      $query = $this->db->query($query); 
      $result = $query->result(); 
      return $result; 
     } 

這基本上得到一排的一些信息，但是我真正想知道的是如何 其轉換爲準備MySQL的說法，我想下面的計算器不同的方法和一些YouTube的教程，但他們不工作，所以有人可以幫助我在準備好的sql語句中編寫這段代碼。

我嘗試了這種方式

$stmt = $conn->prepare(select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment 
          from useropenloan a 
          where a.Owner = :id and UPDATE_DT is null); 
$stmt->bindParam(':id', $id); 
$stmt->execute(); 

Answer 1

public function getOpenLoans($id){ 
    $sql = "select a.Amount as OpenLoanAmount , a.monthly_amortization as totalInstallment from useropenloan a where a.Owner = ? and UPDATE_DT is null"; 
    $query = $this->db->query($sql, array($id)); 
    $result - $query->result(); 
    return $result; 
}