Question

我假设是＆＃34;布尔＆＃34;它出现了＆＃34;假＆＃34; ... 任何人都可以解释这里可能有什么问题？我的代码可能完全有缺陷，但我想提出一些建设性的批评。

<?php 

if ($_SERVER['REQUEST_METHOD'] = "POST") {

include("mytableconn.php");

$firstName = mysqli_real_escape_string($conn, trim($_POST['firstn']));
$lastName = mysqli_real_escape_string($conn, trim($_POST['lastn']));
$email = mysqli_real_escape_string($conn, trim($_POST['uemail']));
$password = mysqli_real_escape_string($conn, trim($_POST      ['userpasscode']));
$cryption = "$2y$10$";
$chars = "thisisseriouslyfucked1";
$crypchar = $cryption . $chars;
$crypass = crypt($password, $crypchar);

$user = $conn->prepare("
INSERT INTO mytable(first_name, last_name, e_mail, pass_word)
VALUES(?, ?, ?, ?)
");

$user = $user->bind_param("ssss", $firstName, $lastName, $email,   $crypass);

$user->execute();

$user->close();
$conn->close();


}else {

echo("Sorry, an unexpected error occurred");

}





?>

Answer 1

当您将prepare sql指定为变量时，您应该先测试该变量，然后再继续检查sql是否有效。

mysqli_prepare（）返回一个语句对象，如果有错误则返回FALSE 发生

<?php 

    if ( $_SERVER['REQUEST_METHOD'] = "POST" ) {

        include("mytableconn.php");

        $firstName = mysqli_real_escape_string($conn, trim($_POST['firstn']));
        $lastName = mysqli_real_escape_string($conn, trim($_POST['lastn']));
        $email = mysqli_real_escape_string($conn, trim($_POST['uemail']));
        $password = mysqli_real_escape_string($conn, trim($_POST['userpasscode']));

        $cryption = "$2y$10$";
        $chars = "thisisseriouslyfucked1";
        $crypchar = $cryption . $chars;
        $crypass = crypt( $password, $crypchar );



        $stmt = $conn->prepare("insert into `mytable` ( `first_name`, `last_name`, `e_mail`, `pass_word` ) values (?, ?, ?, ?)");

        if( $stmt ){
            $stmt->bind_param("ssss", $firstName, $lastName, $email, $crypass);
            $stmt->execute();
            $stmt->close();
        }
        $conn->close();


    }else {
        echo("Sorry, an unexpected error occurred");
    }
?>

全新的编码：致命错误：在布尔

1 个答案: