Question

好。所以我做了一个表格。如果我将mysql_real_escape_string放在从表单检索到的变量$usrname（是的拼写正确）上，它会将我的另一个变量$verify作为false返回。看看：

<html>
<body>
<?php  

session_start();

include("mainmenu.php");  

$usrname = $_POST['usrname']; 
$password = sha1($_POST['password']);

$con = mysql_connect("localhost", "root", "Y0U_C@NT_H@NDLE_THE_TRUTH!");
 if(!$con){
  die("Unable to establish connection with host. We apologize for any inconvienience.");
}

mysql_select_db("users", $con) or die("Can't connect to database.");

$select = "SELECT * FROM `data` WHERE usrname = '$usrname' and
password = '$password'";
$query = mysql_query($select);
$verify = mysql_num_rows($query);

if($verify==1){
    $_SESSION["valid_user"] = $usrname;
    header("location:index.php");
}
else{
     echo "Wrong username or password. Please check that CAPS LOCK is off.";
     echo "<br/>";
     echo "<a href=\"index.php\">Back to login</a>";
} 

mysql_close($con);

?> 
</body>

如果我将mysql_real_escape_string放入我的注册表单或登录表单中，则会将$verify作为false返回。怎么了？

Answer 1

请确保PHP设置中的“Magic Quotes”已关闭。 here解释了如何禁用它。

mysql_real_escape_string导致问题？

1 个答案: