It does properly handle escaping special characters as entities in text, but other than that it's up to the calling program to use the interface properly.
它确实能够正确地将特殊字符转义作为文本中的实体处理，但除此之外，则需要调用程序正确使用该接口。
Escaping special characters tells your database that the characters provided in the query are in fact data, not code.
转义特殊的字符会告诉数据库，查询中提供的字符实际上是数据，而不是代码。
应用推荐