可以写出具体代码案例吗

当使用参数化查询或预处理语句时，PHP代码示例如下：

使用PDO预处理语句的示例：

// 数据库连接信息
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDBPDO";

// 创建连接
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);

// 准备 SQL 语句
$stmt = $conn->prepare("SELECT * FROM users WHERE username = :username AND password = :password");

// 绑定参数
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// 设置参数并执行查询
$username = 'user1';
$password = 'pass1';
$stmt->execute();

// 获取查询结果
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);

使用mysqli预处理语句的示例：

// 数据库连接信息
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = mysqli_connect($servername, $username, $password, $dbname);

// 准备 SQL 语句
$stmt = mysqli_prepare($conn, "SELECT * FROM users WHERE username = ? AND password = ?");

// 绑定参数
mysqli_stmt_bind_param($stmt, "ss", $username, $password);

// 设置参数并执行查询
$username = 'user1';
$password = 'pass1';
mysqli_stmt_execute($stmt);

// 获取查询结果
$result = mysqli_stmt_get_result($stmt);
$rows = mysqli_fetch_all($result, MYSQLI_ASSOC);

当使用转义字符或安全的编码方式对用户输入进行处理时，PHP代码示例如下：

使用mysqli_real_escape_string()函数进行转义：

// 数据库连接信息
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// 创建连接
$conn = mysqli_connect($servername, $username, $password, $dbname);

// 处理用户输入
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

// 执行查询
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);
$rows = mysqli_fetch_all($result, MYSQLI_ASSOC);

使用htmlspecialchars()函数进行编码：

// 处理用户输入
$username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');
$password = htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');

// 执行查询
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);
$rows = mysqli_fetch_all($result, MYSQLI_ASSOC);

以上代码示例仅供参考，具体实现方式需要根据实际情况进行调整。