使用PDO

Question

我有一个注册页面，用户输入他们的姓名和电子邮件，然后向他们发送激活电子邮件。这是有效的，但我被告知我需要使用pdo使其更安全。现在，当我点击提交时，它会运行所有内容而不会出现错误，但用户不会添加到数据库中。这是我的代码：

<?
session_start();

include 'db.php';
$dbh = new PDO("mysql:host=$dbhost;dbname=$database_name", $dbusername, $dbpasswd);


// Define post fields into simple variables
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$username = $_POST['username'];
$email_address = $_POST['email_address'];
$password = $_POST['password'];
$confirm_password = $_POST['confirm_password'];
$hash = password_hash($password, PASSWORD_DEFAULT);


/* Let's strip some slashes in case the user entered
any escaped characters. */

$first_name = stripslashes($first_name);
$last_name = stripslashes($last_name);
$username = stripslashes($username);
$email_address = stripslashes($email_address);



if((!$username) || (!$email_address)){
    echo 'You did not submit the following required information! <br />';
    if(!$username){
        echo "Username is a required field. Please enter it below.<br />";
    }
    if(!$email_address){
        echo "Email Address is a required field. Please enter it below.<br />";
    }
    include 'register.html'; // Show the form again!
    /* End the error checking and if everything is ok, we'll move on to
     creating the user account */
    exit();  //if the error checking has failed, we'll exit the script!
}


 if ( $password <> $confirm_password ){
    echo "<br /><strong><div style=color:#FF0000;><center>Password and confirm password do not match!<BR></center></div></strong>";
    include 'register.html';
    exit(); 
}


/* Let's do some checking and ensure that the user's email address or username
 does not exist in the database */

 $sql_email_check = mysql_query("SELECT email_address FROM users WHERE email_address='$email_address'");
 $sql_username_check = mysql_query("SELECT username FROM users WHERE username='$username'");

 $email_check = mysql_num_rows($sql_email_check);
 $username_check = mysql_num_rows($sql_username_check);

 if(($email_check > 0) || ($username_check > 0)){
    echo "<br /><div style=color:#FF0000;><center>Please fix the following errors: </div><br /><br />";
    if($email_check > 0){
        echo "<strong><div style=color:#FF0000;><center>Your email address has already been used by another member in our database. Please submit a different Email address!</div><br />";
        unset($email_address);
    }
    if($username_check > 0){
        echo "<strong><div style=color:#FF0000;><center>The username you have selected has already been used by another member in our database. Please choose a different Username!</div><br />";
        unset($username);
    }
    include 'register.html'; // Show the form again!
    exit();  // exit the script so that we do not create this account!
 }

/* Everything has passed both error checks that we have done.
It's time to create the account! */

$stmt = $dbh->prepare("insert into users set first_name=?, last_name=?, username=?, email_address=?, password=?");
$stmt->execute([$first_name, $lastname, $username, $email_address, $hash]);

if(!$stmt){
    echo 'There has been an error creating your account. Please contact the webmaster.';
} else {
    $userid = mysql_insert_id();
    // Let's mail the user!

Answer 1

要使用PDO（而不是mysql_insert_id()）获取最后插入的ID，您可以这样做：

$userid = $dbh->lastInsertId();
// Let's mail the user!

要将其余mysql_*个查询转换为PDO，您可能希望执行以下操作：

$sql_email_check = $dbh->prepare("SELECT email_address FROM users WHERE email_address = :email");
$sql_email_check->execute([':email' => $email_address]);
$email_check = $sql_email_check->rowCount();

$sql_username_check = $dbh->prepare("SELECT username FROM users WHERE username = :username");
$sql_username_check->execute([':username' => $username]);
$username_check = $sql_username_check->rowCount();

if (($email_check > 0) || ($username_check > 0)) {
    // ...
}