下面的查询没有告诉我用户名已经存在于数据库中,即使它确实存在。
我正在努力学习如何绑定参数等,但我想我在某个地方搞混了。
<?php
// Include config.php
require_once("".$_SERVER['DOCUMENT_ROOT']."/admin/config.php");
// top.inc.php
require_once($top_inc);
?>
<!-- Meta start -->
<title></title>
<meta name="description" content="" />
<meta name="keywords" content="" />
<!-- Meta end -->
<!-- CONTENT START -->
<?php
// sidebar.inc.php
require_once($sidebar_inc);
// main.inc.php
require_once($main_inc);
// check if form has been submitted
if($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['submit'])){
// initialize form errors array
$error = array();
// fetch form data
$username = $_POST['username'];
$email = $_POST['email'];
$password = $_POST['password'];
// validate form data
if(!preg_match(constant("USERNAME_REGEX"), $username)){
$error[] = "Please enter a username. Use 3 to 15 digits and letters";
}
if(!preg_match(constant('PASSWORD_REGEX'), $password)){
$error[] = "Please enter a password. Minimum of 6 characters required";
}
if(!empty($password) && $password == $username){
$error[] = "Your pasword cannot be you username for security reasons";
}
if(empty($email)){
$error[] = "Please enter your email address";
}
if(!empty($email) && !filter_var($email, FILTER_VALIDATE_EMAIL)){
$error[] = "Your email address is not valid";
}
// connect to database
sql_con();
// Get instance of statement
$stmt = mysqli_stmt_init($connect);
// sql statement
$UserExists = "
SELECT
`user_login`
FROM
`users`
WHERE
`user_login` = ? ";
// prepare sql statement for execution
if (mysqli_stmt_prepare($stmt, $UserExists)) {
// bind parameters [s for string]
mysqli_stmt_bind_param($stmt, "s", $username) or die(mysqli_stmt_error());
// execute statement
mysqli_stmt_execute($stmt) or die(mysqli_stmt_error());
// check if username is found
if(mysqli_stmt_num_rows($stmt) > 0 ){
$error[] = 'The username you have choose has already been taken';
}
}
// If errors found display errors
if(!empty($error)){
foreach($error as $msg){
echo "$msg <br />";
}
} else {
echo 'My Query Worked!';
}
}
// signup.tpl template location
$tpl = 'inc/tpl/signup.tpl';
// load signup form template
PageContentTemplate($tpl);
?>
<!-- CONTENT FINISH -->
<?php
// footer.inc.php
require_once($footer_inc);
?>
基本上它只是发出 "My Query Worked "的声音,即使它应该说用户名已经存在,而事实也是如此,我在表单上输入了细节和一个我知道已经存在的用户名,然后提交了表单,我知道我做的事情可能真的很傻,但作为mysqli和绑定参数等方面的新手。我不知道我哪里出了问题,即使我已经看了一些例子。
说实话,我不知道这是不是程序式的最好方法,我不懂PDOOOP,我改的主要原因是为了避免在查询中使用占位符等进行SQL注入。
我现在明白了。你没有调用 mysqli_stmt_store_result()
在此之前 mysqli_stmt_num_rows()
不会报告正确的值。
// prepare sql statement for execution
if (mysqli_stmt_prepare($stmt, $UserExists)) {
// bind parameters [s for string]
mysqli_stmt_bind_param($stmt, "s", $username) or die(mysqli_stmt_error());
// execute statement
mysqli_stmt_execute($stmt) or die(mysqli_stmt_error());
// check if username is found
// FIRST : store the store the result set so num_rows gets the right value
mysqli_stmt_store_result($stmt);
// Now this should be 1 instead of 0
if(mysqli_stmt_num_rows($stmt) > 0 ){
$error[] = 'The username you have choose has already been taken';
}
}
返回结果集中的行数。mysqli_stmt_num_rows()的使用取决于你是否使用mysqli_stmt_store_result()来缓冲语句句柄中的整个结果集。
如果你使用了mysqli_stmt_store_result(),mysqli_stmt_num_rows()可能会被立即调用。