Question

我一直盯着这个页面半小时试图弄清楚我哪里出错了。找到前两个变量并将其插入到数据库中，但最后两个，'email'和'password'未找到，未插入数据库但仍传递if语句。任何帮助将不胜感激。

form.php的

        <form name="signup" method="POST" action="signup.php">

        <label for="signupFirstName">First Name</label>
        <input type="text" id="signupFirstName" name="signupFirstName" />
        <label for="signupLastName">Last Name</label>
        <input type="text" id="signupLastName" name="signupLastName"/>

        <label for="signupEmail">Email</label>
        <input type="text" id="signupEmail" name="signupEmail" />
        <label for="signupConfirmEmail">Confirm Email</label>
        <input type="text" id="signupConfirmEmail" name="signupConfirmEmail"/>

        <label for="signupPassword">Password</label>
        <input type="text" id="signupPassword" name="signupPassword"/>
        <label for="signupConfirmPassword">Confirm Password</label>
        <input type="text" id="signupConfirmPassword" name="signupConfirmPassword"/>

        <button name="submit" type="submit" >Submit Form</button>

        </form>

signup.php

     <?php
    if (isset($_POST['signupFirstName']) || isset($_POST['signupLastName']) ||     isset($_POST['signupEmail']) || isset($_POST['signupPassword']) ) {

    echo $_POST['signupEmail'];
    $mysqli = new mysqli('localhost', 'user1', 'password', 'db2');

    /* check connection */
    if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
    }

    $stmt = $mysqli->prepare("INSERT INTO members (First_Name, Last_Name, Email, Password) VALUES (?,?,?,?)");
    $stmt->bind_param('ssss',$sample,$lastName,$email,$password);


    // escape the POST data for added protection
    $sample = isset($_POST['signupFirstName'])
        ? $mysqli->real_escape_string($_POST['signupFirstName'])
        : '';
    $lastName = isset($_POST['signupLastName'])
        ? $mysqli->real_escape_string($_POST['signupLastName'])
        : '';     
    $email = isset($_POST['signupEmail'])
        ? $mysqli->real_escape_string($_POST['signupEmail'])
        : '';
    $password = isset($_POST['signupPassword'])
        ? $mysqli->real_escape_string($_POST['signupPassword'])
        : '';


    /* execute prepared statement */
    $stmt->execute();

    printf("%d Row inserted.\n", $stmt->affected_rows);

    /* close statement and connection */
    $stmt->close();

    /* close connection */
    $mysqli->close();
}
    else{
    echo "broken";
    }
?>

Answer 1

在实际设置变量之前，您似乎将params绑定到查询。将bind_param()来电移至execute()来电之上。

您还可以重构代码以获取大量垃圾。示例如下：

<?php
function arr_get($array, $key) {
    if (isset($array[$key])) {
        return $array[$key];
    }

    return '';
}

if (isset($_POST['signupFirstName']) || isset($_POST['signupLastName']) || isset($_POST['signupEmail']) || isset($_POST['signupPassword']) ) {

    echo $_POST['signupEmail'];
    $mysqli = new mysqli('localhost', 'user1', 'password', 'db2');

    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }

    $stmt = $mysqli->prepare("INSERT INTO members (First_Name, Last_Name, Email, Password) VALUES (?,?,?,?)");
    $stmt->bind_param('ssss', arr_get($_POST, 'signupFirstName'), arr_get($_POST, 'signupLastName'), arr_get($_POST, 'signupEmail'), arr_get($_POST, 'signupPassword'));

    /* execute prepared statement */
    $stmt->execute();

    printf("%d Row inserted.\n", $stmt->affected_rows);

    /* close statement and connection */
    $stmt->close();

    /* close connection */
    $mysqli->close();

}
else {
    echo "broken";
}
?>

将变量发送到MySQLi

1 个答案: