Question

我在这个网站上经历了很多不同的代码。找出我的代码有什么问题。基本上我只想在表中搜索并测试结果。我写了这样的话：

<?php

ob_start();
session_start();

$conn = new mysqli('localhost','username','password','mytable');

if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

$valuetotest = 'something';
$result = mysql_query("SELECT id FROM members WHERE UserName = $valuetotest");

if(mysql_num_rows($result) == 0) 
{ 
    echo "User not found";
}

$password = 'something2';
$userData = mysql_fetch_array($result, MYSQL_ASSOC);

if($password != $userData['Password']) 
{
echo "Password not found";
}else{ // Redirect to home page after successful login.
            header('Location: welcome.php');
}
?>

我总是消息：

"User not found." and "password not found."

当我知道用户名和密码在表格中时......

不，我对PHP / MySQL非常了解，所以在我面前可能会有一些非常大的东西，我看不到它!!!!

请有人帮忙吗。感谢名单。

Answer 1

不到一秒即可发现。（如果你有错误报告就会花费甚至更少）

1）您的连接是 mysqli ，但您的查询电话是 mysql

$result = mysql_query("SELECT id FROM members WHERE UserName = $valuetotest");

2）$valuetotest的值是一个字符串值，需要在查询中的引号内。应该像

SELECT id FROM members WHERE UserName = 'hellohi'

并不喜欢

SELECT id FROM members WHERE UserName = hellohi

哦，How can I prevent SQL injection in PHP?

Answer 2

<?php

$result = mysqli_query("SELECT `id`, `Password` FROM `members` WHERE `UserName` = '$valuetotest'");

if(mysqli_num_rows($result) == 0) 
{ 
    echo "User not found";
}

$password = 'something2';
$userData = mysqli_fetch_array($result, MYSQL_ASSOC);

if($password != $userData['Password']) 
{
echo "Password not found";
}else{ // Redirect to home page after successful login.
            header('Location: welcome.php');
}

?>

Answer 3

您正在选择文本，因此您应该在Select语句中使用''符号。像这样：

$valuetotest = 'something';
$result = mysql_query("SELECT id FROM members WHERE UserName = '$valuetotest'");

Answer 4

$result = mysql_query("SELECT id FROM members WHERE UserName = '".$valuetotest."'");

MySQL选择不选择

4 个答案: