PHP登录脚本问题

Question

我的登录脚本上有几个问题。它只是引导我到一个没有错误的空白页面。

• 如果我使用的是mysqli，那么在查询中是否需要使用?或$username和$password？
• 我不明白$stmt -> fetch()发生了什么；我是否正确地使用了它？
• $result=mysqli_query($stmt);：这个$result变量包含用户名和密码吗？
• 如果是这样的话，mysqli_num_rows($result)是如何工作的？

  <?php 
    function clean($str)
       {
            $str = @trim($str);
            if(get_magic_quotes_gpc()) {
                $str = stripslashes($str);
            }
            return mysql_real_escape_string($str);
        }


        //Sanitize the POST values

    $username = clean($_POST['username']);
    $password = clean($_POST['password']);

    /* Create a new mysqli object with database connection parameters */
    $mysqli = mysqli_connect('localhost', 'root', '', 'draftdb');

    if(mysqli_connect_errno()) 
    {
          echo "Connection Failed: " . mysqli_connect_errno();
          exit();
    }
       /* Create a prepared statement */
    if($stmt = $mysqli -> prepare("SELECT Login_ID, Login_PW,
    FROM login  
    WHERE Login_ID='$username' AND Login_PW ='".md5($_POST['password'])."'"))
     {


          /* Bind parameters
             s - string, b - boolean, i - int, etc */
          $stmt -> bind_param("ss", $username, $password);

          /* Execute it */
          $stmt -> execute();

          /* Bind results */
          $stmt -> bind_result($username, $password);

          /* Fetch the value */

         while ($stmt->fetch()) 
         { 
              $result=mysqli_query($stmt);

        //Check whether the query was successful or not
        if($result)
         {//main if
            if(mysqli_num_rows($result) == 1) 
            {
                //Login Successful
                session_regenerate_id();
                $login = mysqli_fetch_assoc($result);
                $_SESSION['SESS_MEMBER_ID'] = $login['Login_ID'];
                //$_SESSION['SESS_FIRST_NAME'] = $login['firstname'];
                //$_SESSION['SESS_LAST_NAME'] = $login['lastname'];
                session_write_close();
                header("location: member-index.php");
                exit();
            }
            else {
                //Login failed
                header("location: login-failed.php");
                exit();
                 }
            }
            else 
            {
            die("Query failed");
            }


         }//main if close


          /* Close statement */
          $stmt -> close();
       }

       /* Close connection */
       $mysqli -> close();
    ?>

Answer 1

我试着回答你们的每一个问题，但是，他们太复杂了，我不能只给出每个问题的答案。因此，我冒昧地修改了您发布的脚本，我相信这将使它工作。也许还有必要做一些额外的调整。请回顾我添加的评论内联。此外，查看以下php文档页，以获得有关以面向对象的形式使用mysqli函数的更多信息：

http://www.php.net/manual/en/mysqli-stmt.num-rows.php

http://www.php.net/manual/en/mysqli-stmt.execute.php

http://www.php.net/manual/en/mysqli-stmt.bind-result.php

http://www.php.net/manual/en/mysqli-stmt.bind-param.php

我还没有测试它，我可能会有一两次错误，但是下面是我改进您的脚本的尝试。让我知道你的想法：

<?php 
function clean($str)
{
    $str = @trim($str);
    if(get_magic_quotes_gpc()) {
        $str = stripslashes($str);
    }
    return mysql_real_escape_string($str);
}

//Sanitize the POST values

$username = clean($_POST['username']);
$password = clean($_POST['password']);

/* Create a new mysqli object with database connection parameters */
$mysqli = mysqli_connect('localhost', 'root', '', 'draftdb');

if(mysqli_connect_errno()) 
{
    echo "Connection Failed: " . mysqli_connect_errno();
    exit();
}

/* Is your username the same as the login_id? If not you need to change this query's where to use the username column not the login_id. */

/* Create a prepared statement */
if($stmt = $mysqli -> prepare("
    SELECT Login_ID, firstname, lastname
    FROM login  
    WHERE Login_ID=? AND Login_PW=?
"))
{
    /* Bind parameters
         s - string, b - boolean, i - int, etc */
    $stmt -> bind_param("ss", $username, md5($password));

    /* Execute it */
    $result = $stmt -> execute();

    //Check whether the query was successful or not
    if ($result === false) {
        die("Query failed");
    }

    /* Bind results to variables that will be used within the fetch() loop. */
    $stmt -> bind_result($login_id, $firstname, $lastname);

    /* Check the number of rows returned. */
    if ($stmt->num_rows !== 1) {
        //Login failed
        header("location: login-failed.php");
        exit();
    }

    /* Iterate over the results of the query. */
    while ($stmt->fetch()) 
    { 
        //Login Successful
        session_regenerate_id();
        /* We can use $login_id, $firstname and $lastname cause we binded the result to those variables above. */
        $_SESSION['SESS_MEMBER_ID'] = $login_id;
        //$_SESSION['SESS_FIRST_NAME'] = $firstname;
        //$_SESSION['SESS_LAST_NAME'] = $lastname;
        session_write_close();
        header("location: member-index.php");
        exit();
     }//main if close

      /* Close statement */
      $stmt -> close();
   }

   /* Close connection */
   $mysqli -> close();
?>

Answer 2

1. 当您使用准备好的语句时，通常不应该在语句中替换变量。你放的？占位符，然后使用$stmt->bind_param()将这些占位符与变量关联。
2. 使用$stmt->fetch()后，可以引用与$stmt->bind_result绑定的变量来访问SELECT的结果。
3. 如果您使用的是准备好的语句，则根本不应该使用mysqli_query。要回答关于它是如何工作的问题，$result不包含实际数据。您可以调用类似的$row = mysqli_fetch_assoc($result)将用户名和密码输入到$row中。
4. 你应该使用$stmt->num_rows()

Answer 3

我认为，问题在于您的代码的这一部分

 while ($stmt->fetch()) 
     { 
          $result=mysqli_query($stmt);

您已经执行了该语句，并获取了它；不需要再次查询它。。。。我不熟悉mysqli，因为我使用PDO，但是我认为由于您将结果绑定到$username，所以$password可以使用这些绑定变量访问返回的值。

while ($result = $stmt->fetch()) 
 { 
if($result->num_rows == 1) 
        {
$_SESSION['SESS_MEMBER_ID'] = $result['LOGIN_ID']
//////or $_SESSION['SESS_MEMBER_ID'] = $username  

我想你可以这样做。。。