Question

我目前正在做一个有关SQL注入的项目，我必须对此采取对策。我一直在尝试使用准备好的声明作为对策。但是目前我尝试了几个小时之后，却无法做到。它一直使我的页面上出现一个纯白色的屏幕，该屏幕可能会重定向到另一个页面或显示一条消息

这里是代码 doLogin页面：

<?php
session_start();
require('dbFunction.php');
$username = $_POST['form-username'];
$password = SHA1($_POST['form-password']);
$msg = "";

$stmt = $link -> prepare("SELECT * FROM User WHERE Email = ? AND Password = ?");
$stmt -> bind_param('ss', $username, $password);
$stmt -> execute();

if($stmt -> get_result() -> num_rows > 0) {
$row = $stmt-> get_result() ->fetch_assoc();
$_SESSION['email'] = $row['Email'];
$_SESSION['userId'] = $row['UserId'];
$_SESSION['role'] = $row['role'];
$_SESSION['First_name'] = $row['First_name'];
header("location:index.php");
}
else{
$msg .= "Wrong user combination.";
}

$stmt -> close();
$link -> close();

include "navbar.php";
echo $msg;
echo error_get_last();

?>

这是我的数据库连接的代码：

<?php
$db_host = "localhost";
$db_username = "root";
$db_password = "P@$\$w0rd";
$db_name = "mydb";
$link = mysqli_connect($db_host,$db_username,$db_password,$db_name);

if(!$link){
die(mysqli_error($link));
}

Answer 1

尝试使用此：

<?php
$db_host = "localhost";
$db_username = "root";
$db_password = "P@$\$w0rd";
$db_name = "mydb";
$link = new mysqli($db_host,$db_username,$db_password,$db_name);

if ($link->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

使用MYSQL数据库在PHP中准备的语句

1 个答案: