文件 * 示例.html*

<form action="sample.php" method="POST">
    <input name="name" type="text">
    <input name="text" type="text">
    <input name="submit" type="submit" value="Submit">
</form>

文件 * 示例.php*

<?php

if (isset($_POST['submit'])) {
    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
    $mysqli = new mysqli('localhost', 'user', 'password', 'mysampledb');

    // replace every piece of data in SQL with question mark 
    $sql = "INSERT INTO SampleTable (name, text) VALUES (?,?)"
    //                                  2 question marks ^^^
    // prepare this query
    $stmt = $mysqli->prepare($sql);
    // bind every variable, adding s for each to the types string
    $stmt->bind_param('ss', $_POST['name'], $_POST['text']);
    //     2 s letters ^^        ^^   2 variables   ^^

    /* Execute prepared statement */
    $stmt->execute();
}

这是一个非常基本的例子。今天许多PHP开发者都转向PDO。Mysqli并没有过时，但是PDO要容易得多。