Much safer would be to encode the tainted value of $name to a SQL string literal and use the result in the SQL query, guaranteeing that no dangerous command embedded in $name will be evaluated.
更安全的方法是将$name的污点值编码到一个SQL字符串字面值和使用SQL查询的结果，这保证了没有嵌入在$name的危险命令会被执行。