$sql = "select * from kami where kami='$tqmval'"; $res = mysqli_query($conn, $sql); $row = mysqli_fetch_array($res); 请优化这段代码防止SQL注入

可以使用参数化查询来防止SQL注入，修改代码如下：

$stmt = $conn->prepare("SELECT * FROM kami WHERE kami = ?");
$stmt->bind_param("s", $tqmval);
$stmt->execute();
$result = $stmt->get_result();
$row = $result->fetch_assoc();