PHP 函数参数绑定的最佳实践？

$username = 'jsmith';$password = 'password123';$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";$result = mysql_query($query);

$stmt = mysql_stmt_init($conn);$query = "SELECT * FROM users WHERE username = ? AND password = ?";mysql_stmt_prepare($stmt, $query);mysql_stmt_bind_param($stmt, "ss", $username, $password);mysql_stmt_execute($stmt);$result = mysql_stmt_get_result($stmt);mysql_stmt_close($stmt);