PHP MySQL列无效

Question

在过去的四天里，我一直在尝试让它正常工作。这只是一个简单的登录页面，其中没有存储敏感信息，但我在使用PHP时遇到了问题。

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $uname = $_POST["login"];
    $pword = $_POST["pass"];
    $uname = htmlspecialchars($uname);
    $pword = htmlspecialchars($pword);
    $user_name = "bradf294_access";
    $password = "********";
    $database = "bradf294_clients";
    $server = "localhost";
    $db_handle = mysql_connect($server, $user_name, $password);
    $db_found = mysql_select_db($database, $db_handle);
    print(mysql_errno());
    print($db_found);
    if(isset($db_found)){
        print($db_found."Success");
        $SQL = "SELECT * FROM basicinfo WHERE ref = $uname AND pass = $pword";
        $result = mysql_query($SQL);
        print("Query made");
        print(mysql_errno());
        if ($result) {
            print("result:".$result);
        }
        else {
            print("Incorrect Login Details");
        }
        if ($result > 0) {
            print("found user");
            $errorMessage= "logged on ";
            session_start();
            $_SESSION['login'] = "1";
            header ("Location: progressuser.php");
        }
        else {
            print("Invalid Logon");
        }
    } else {
        print("Database not found. The Webmaster has been notified. Please try again   later");
        $subject = "Automated login error" ;
        $message = "An error occured whilst trying to connect to the MySQL database, to login to the progress checker" ;
        mail("a-bradfield@bradfieldandbentley.co.uk", $subject, $message);
    }

从我用来调试的页面上的输出来看，似乎是那些似乎不起作用的代码行给出了一个1054错误--“未知的列'%s‘in '%s'”

$SQL = "SELECT * FROM basicinfo WHERE ref = $uname AND pass = $pword";
$result = mysql_query($SQL)

即使我将$SQL字符串复制并粘贴到phpMyAdmin中，它也能完美地工作吗？

有什么明显的地方是我做错了吗？转到http://www.bradfieldandbentley.co.uk/test/progress.php并输入详细信息引用：TST001，然后传递：dnatbtr121亲自查看输出。

Answer 1

您需要将变量引起来：

$SQL = "SELECT * FROM basicinfo WHERE ref = '$uname' AND pass = '$pword'";

然而，

mysql_*函数正在被弃用-您应该考虑改为使用PDO或mysqli_*。这两种方法都使您可以更轻松地编写安全的代码，并为您修复引用问题。

Answer 2

WHERE条件中的值不应该像普通的MySQL语句那样用引号括起来吗？是。此外，您还将获得一大堆关于SQL注入的评论。