Question

此代码应检查现有用户名，如果没有，则应创建一个新用户名。无论它不会添加什么。另外，正如您在代码中看到的那样，它只回显'here'并且不回应'not here'。

<?php 

$password = "hey";
$username = "hi";
require "conn.php";
//$password = $_POST["password"];
//$username = $_POST["username"];

echo 'here';
$result = $conn->query("SELECT * FROM UserData WHERE username ='$username' ", MYSQLI_USE_RESULT);
echo 'not here';
if ($result) { 

    if($result->num_rows === 0)
    {

        $stmt = $conn->prepare("INSERT INTO UserData (username,password) VALUES (:username,:password)");
        $params = array(
            ':username' => $username,
            ':password' => $password
        );
        $stmt->execute($params);
    }

}
?>

这是连接代码：

    <?php 
    //$db_name = "xxx";
    //$mysql_username = "xxx";
    //$mysql_password = "xxx";
    //$server_name = "xxx";
    // Create connection
    $conn = new mysqli("xxx","xxx","xxx","xxx");
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    } 
    echo "Connected successfully";

    ?>

的变化：

<?php 
require "conn.php";
echo "debug 1";
$stmt = $conn->prepare("SELECT * FROM UserData WHERE username = ?");
$stmt->bind_param('s', /*$_POST["username"]*/ $username );
$username = 'hi'; 
$stmt->execute();
$stmt->store_result();

echo "debug 2";
if ($stmt->num_rows == 0){ // username not taken
  echo "debug 3";
  $stmt2 = $conn->prepare("INSERT INTO UserData (username, password) VALUES (?, ?)");
  $password =(/*$_POST["password"]*/ "hey");
  $username =(/* $_POST["username"]*/ "hi");  
  $stmt2->bind_param('s',$username);
  $stmt2->bind_param('s',$password);
  $stmt2->execute();
  if ($stmt2->affected_rows == 1){
    echo 'Insert was successful.';

  }else{ echo 'Insert failed.';
   var_dump($stmt2);
  }
}else{ echo 'That username exists already.';}

?>

此代码完成所有调试但由于某种原因，它仍未插入。

Answer 1

替换此行 $result = **$mysqli->**query("SELECT * FROM UserData WHERE username ='$username' ", MYSQLI_USE_RESULT); 以下 $result = **$conn->**query("SELECT * FROM UserData WHERE username ='$username' ", MYSQLI_USE_RESULT);

Answer 2

The mysqli and PDO interfaces must not be mixed. Here the database connection and the SELECT query are both using the mysqli interface. But the second INSERT query is attempting to use the PDO interface, as evidenced by the use of named placeholders, and also the passing of a data array directly to execute(). The latter two features are not supported by mysqli, hence the code fails at the second query. Also, note that the second query is using prepared statements, while the first one is not. Again, different approaches should not be mixed together.

Also it appears that passwords are being stored as plain text, with no security. The proper approach is to use the password_hash function. Just ensure that the database field has enough width (say 80-120 characters or more) to handle the current bcrypt hash, plus allow some more for future changes.

Staying with the mysqli interface (and with password_hash), the code could go something like this:

$stmt = $conn->prepare("SELECT * FROM UserData WHERE username = ?");
$stmt->bind_param('s', $_POST["username"]);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 0){ // username not taken
  $stmt2 = $conn->prepare("INSERT INTO UserData (username, password) VALUES (?, ?)");
  $password = password_hash($_POST["password"], PASSWORD_DEFAULT);
  $stmt2->bind_param('s', $_POST["username"]);
  $stmt2->bind_param('s', $password);
  $stmt2->execute();
  if ($stmt2->affected_rows == 1)
    echo 'Insert was successful.';    
  else echo 'Insert failed.';
}
else echo 'That username exists already.';

Note that the above approach would not be suitable for a high-traffic site, where there is a chance condition of another user trying to INSERT the same username, during the brief interval of time between the SELECT and INSERT database queries. That would require a different approach, like ensuring the subject database field is set to UNIQUE (which is good practice anyway), and then testing for violation of that UNIQUE field upon attempted duplicate insertion.

Assuming database and INSERT permissions are all set up OK and it is still not inserting, try enhancing the error-reporting.

Ensure the following are at the top of the page:

ini_set('display_errors', true); 
error_reporting(E_ALL);

And put the following before the first query:

$driver = new mysqli_driver();
$driver->report_mode = MYSQLI_REPORT_ALL;

Then try again.

PHP没有发布到mySQL数据库

2 个答案: