Question

我是php的初学者，我想检查输入的用户名是否已经存在。

这是我的代码。

<?php
ini_set('display_errors',1); 
error_reporting(E_ALL);

if (isset($_POST['submit'])) {
include "connect.php";
ValidateUser();
}


function ValidateUser() 
{
if (!empty($_POST['username']) AND !empty($_POST['password'])) {
$queryrow=mysqli_query("SELECT * FROM websiteusers WHERE username = '$_POST['username']'");
if ($rows=mysqli_num_rows($queryrow)=0) {
     RegisterUser();
  }
}

function RegisterUser() {
echo "works up to here";
}
?>

尽管报告了错误报告，但它甚至没有给我一个错误。

Answer 1

你有没有初始化mysqli_connect？

$Connection =  mysqli_connect("host","user","pass","database");

然后将其传递给使用mysqli_query() by：

的函数

function foo ($DB){
  mysqli_query($DB,"QUERY HERE");
  // Do other stuff
  return /* Whatever you wish to return here*/
}
foo($Connection);

Answer 2

这是正确的方法：

<?php
ini_set('display_errors',1); 
error_reporting(E_ALL);

if (isset($_POST['submit'])) {
    $mysqli = new mysqli("localhost", "user", "password", "database");
    if ($mysqli->connect_errno) {
        echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
    }

    if(check_user($mysqli, $_POST['username']){
        registerUser();
    }else{
        echo 'user exist, cannot register';
    }

}

function check_user($conn, $username){
    $query = "SELECT * FROM websiteusers WHERE username = ?";

    if ($stmt = $conn->prepare($query)) {
        $stmt->bind_param("s", $username);
        $stmt->execute();
        $stmt->close();
    }

    return $stmt->num_rows === 0;
}


function registerUser() {
    echo "registering user ...";
}

阅读prepared statement

Answer 3

使用以下代码可以非常轻松地完成您要实现的目标。更重要的是安全问题。每次用户有机会输入文本时，最好对输入进行清理。

此外，使用准备好的查询还会增加另一层安全性。

虽然这不是直接使用您提供的代码，但我相信教好习惯是好的。

如果您有任何问题，请随时提出。

$username = $_POST['username']; <-- sanitize this
$message = null;
$mysqli = new mysqli("localhost", "user", "password", "database");

$stmt = $mysqli->prepare("SELECT username FROM websiteusers WHERE username=?");
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($usernamesql);
$stmt->fetch();

if ($stmt->num_rows() > 0) {
    RegisterUser();
} else {
    $message .= 'username already exists';
}

稍后当您需要查询更多项目或更多结果时，

$stmt = $mysqli->prepare("SELECT username,password,other1,other2 FROM websiteusers WHERE username=?");
$stmt->bind_param('s', $username); <-- the "s" means the argument is a strings, if a argument is stored as an int use "i", but one character for each argument is required.
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($usernamesql);
$stmt->fetch();

多个参数：

$stmt = $mysqli->prepare("SELECT username,password,other1,other2 FROM websiteusers WHERE username=? AND authenticated=?");
$stmt->bind_param('si', $username,$isauthenticated); <-- second argument is a INT or BOOL
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($usernamesql,$passwordsql,$other1sql,$other2sql);
$stmt->fetch();

当您期望多个结果时，假设您想将它们转储到数组中：

$userarray = array();

$stmt = $mysqli->prepare("SELECT username FROM websiteusers WHERE username=?");
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($usernamesql);

while($stmt->fetch()){
    array_push($userarray, $usernamesql);
}

$ userarray现在是从数据库中提取的所有结果的数组。

PHP / MySQL：检查用户名是否存在

3 个答案: