Question

我的功能，需要检查我正在使用的电子邮件。如果电子邮件尚未注册。代码将检查用户名是否正在使用。如果它之前没有注册。需要开始执行INSERT Mysqli_query。比问题开始，它没有显示任何问题＆amp;它检查电子邮件＆amp;用户名是正确的，只有mysqli_query命令不起作用。

1）为什么它不起作用？ 2）如何使其更安全？

我的代码：

    if(empty($error)){
        $sqlcon = mysqli_connect("localhost","baruch","","developers");
        $checkemail = mysqli_query($sqlcon,"SELECT `email` FROM `users` WHERE email='$email'");
        if(mysqli_num_rows($checkemail)){echo "האימייל".$email.".בשימוש בחרו באימייל אחר.";}else{
            $checkusername = mysqli_query($sqlcon,"SELECT `username` FROM `users` WHERE username='$username'");
            if(mysqli_num_rows($checkusername)){echo "שם המשתמש: <strong>".$username."</strong> ,נמצא בשימוש ביחרו שם משתמש אחר.";}else{
                mysqli_query($sqlcon, "INSERT INTO `users` (`ID`, `fullname`, `username`, `password`, `email`, `birthday`, `tags`, `gold`, `activation`, `avatarurl`) VALUES ('', '$fullname', '$username', MD5('$password'), '$email', '$birthday', '$tags', '0', '0', MD5('".rand()."'), '')");
                echo $fullname." נרשמת בהצלחה לאתר, בשם המשתמש:".$username;
            }
        }
        mysqli_close($sqlcon);
    }

Answer 1

mysqli_real_escape_string()所有这些$variables：('', '$fullname', '$username', MD5('$password'), '$email', '$birthday', '$tags', '0', '0', MD5('".rand()."'), '')。

赞：$fullname = mysqli_real_escape_string($connection, $fullname);等......

或使用prepared statement为您处理事情。

Answer 2

您有列不匹配错误，

试试这个，

mysqli_query($sqlcon, "INSERT INTO `users` (`ID`, `fullname`, `username`, `password`, `email`, `birthday`, `tags`, `gold`, `activation`, `avatarurl`) 

VALUES ('', '$fullname', '$username', MD5('$password'), '$email', '$birthday', '$tags', '0', '0', '')");

Mysqli_query不要向表中插入细节

2 个答案: