Question

这是我的代码：

$link=mssql_connect($server, 'username','password');
if (!$link) {
die('Something went wrong while connecting to the mssql database, it could be offline! ' . mssql_get_last_message());
                                        }
                                        mssql_select_db('GunzDB', $link);
                                        $result="SELECT * FROM Account WHERE UserID = '$username'";

                                        if(mssql_num_rows($result) > 0){
                                            echo "That username is already in use!";    
                                    } else{
                                        $result="SELECT * FROM Account WHERE Email = '$email'";

                                        if(mssql_num_rows($result) > 0){
                                            echo "That email is already in use!";
                                        } else{

                                            $query="INSERT INTO Account (UserID, UGradeID, PGradeID, RegDate, Name, Email) VALUES ('" . $username . "','0','0','00:00','" . $name . "','" . $email . "')";
                                            if($query){
                                            $result="SELECT * FROM Account WHERE UserID = '$username'";

                                            $row = mssql_fetch_array($result);
                                            $AID=$row['AID'];
                                            $query="INSERT INTO Login (AID, Password) VALUES ('" . $AID . "','" . $password . "')";
                                            if($query){
                                            echo "<span style='color: lime'>Your account has been successfully created!</span>";
                                            } else{
                                                echo "error with MSSQL: " . mssql_get_last_message();
                                            }
                                            } else{
                                             echo "error with MSSQL: " . mssql_get_last_message();  
                                            }

我一直收到这些错误警告：mssql_num_rows（）期望参数1是资源，字符串在第81行的/var/www/gunz/register.php中给出

警告：mssql_num_rows（）期望参数1为资源，第86行/var/www/gunz/register.php中给出的字符串

警告：mssql_fetch_array（）要求参数1为资源，第94行的/var/www/gunz/register.php中给出了字符串

它与这些行有关

$result="SELECT * FROM Account WHERE UserID = '$username'";

$result="SELECT * FROM Account WHERE Email = '$email'";

$result="SELECT * FROM Account WHERE UserID = '$username'";

我可以得到一些帮助吗？

Answer 1

您没有发送查询以获得结果。

$result = mssql_query("SELECT ... ");

你也容易受到SQL注入攻击。阅读使用绑定参数和准备好的声明。

See the manual

mssql_num_row需要1个参数资源

1 个答案: