PHP在mysql数据库中欠细化了可变表。

Question

我收到以下错误消息：

注意:第58行中的未定义变量: /path/mailDB.php中的db_table注意:第59行中的未定义变量: mysqli_db警告: mysqli_query()希望参数1为mysqli，第59行上的/path/mailDB.php中给出的字符串为

谁能告诉我我做错了什么吗？纠正此错误的代码？如果我已正确绑定以防止SQL代码注入？

<?php

//Main Code Sequence
error_reporting(-1);
ini_set('display_errors',1);

//Database Setup    
$db_host = "www.***";
$db_name = "***";
$db_table = "emailUser";
$db_username = "***";
$db_password = "***";
$mysqli_db = new mysqli($db_host,$db_username,$db_password,$db_name);

function webmailSignUp()
{
    $webmailFullName = $_POST['webmailFullName'];
    $webmailUserName = $_POST['webmailUserName'];
    $webmailExEmail = $_POST['webmailExEmail'];
    $webmailPhone = $_POST['webmailPhone'];
    $webmailDOB = $_POST['webmailDOB'];

    //Check that the fields are not empty
    if ((!empty($webmailFullName)) or (!empty($webmailUserName)) or (!empty($webmailExEmail)) or (!empty($webmailPhone)) or (!empty($webmailDOB)))
    {
        //Check that there is no existing name in the table
        if (checkUser($webmailUserName) == false)
        {
            //Adding the person to the Database Query   
            $query = "INSERT INTO $db_table(userFullName,userName,userExEmail,userPhone,userDOB) VALUES(?,?,?,?,?)";
            //Binding to Prevent SQL injection                      
            $requery = $mysqli_db->prepare($query);
            $requiry->bind_param($webmailFullName,$webmailUserName,$webmailExEmail,$webmailPhone,$webmailDOB);
            if ($requery->execute())
            {
                echo "Person has been added";
            }
            else
            {
                echo "bind failed";
            }   
        }
        else
        {
            echo "There is already a user registered with this username.  Please try a different one.";
        }
    }
    else
    {
        echo "One of your fields are blank!  Please try again";
    }
}

function checkUser($userNameCheck)
{
    //Check the field userName is the same as the Posted Username
    $Field = "userName"; //The Field to check
    $query = "SELECT $Field WHERE $Field=$userNameCheck FROM $db_table LIMIT 1"; 
    $result = mysqli_query($query, $mysqli_db) or die(mysql_error());

    if (!$row = mysqli_fetch_array($result) or die(mysql_error()))
    {
        return false; //username was not found in the field in the table
    }
    else
    {
        return true; //username was found in the field in the table
    }
}

function db_close()
{
    $mysqli_db->close();
}

if(isset($_POST['webmailRegisterSubmit']))
{
    webmailSignUp();
    db_close();
    echo "End of Registration";
}
if(isset($_POST['webamilForgottenPWSubmit']))
{
    webmailForgottenPassword();
    db_close();
    echo "End of Password Reset Request";
}
?>

Answer 1

您需要将$mysqli_db作为参数传递给checkUser，或者使其成为全局的。

当前，$mysqli_db在函数中未定义。这适用于需要使用$mysqli_db的任何函数。

如下所示：

function checkUser($userNameCheck)
{
    global $mysqli_db;

或者：

function checkUser( $userNameCheck, $mysqli_db ) {

Answer 2

注意:第58行中的未定义变量: /path/mailDB.php中的db_table注意:第59行中的未定义变量: mysqli_db警告: mysqli_query()希望参数1为mysqli，第59行上的/path/mailDB.php中给出的字符串为

$mysqli_db在您的函数中不可用，它是超出范围。将该变量传递给您的函数

function webmailSignUp($mysqli_db){

然后打电话给我

 webmailSignUp($mysqli_db);

其他要使用该变量的函数也是如此。

Answer 3

你还混淆了这两个对角线：

$result = mysqli_query($query, $mysqli_db) or die(mysql_error());

而不是

$result = mysqli_query($mysqli_db, $query) or die(mysql_error());

来自php.net：

mixed mysqli_query ( mysqli $link , string $query [, int $resultmode = MYSQLI_STORE_RESULT ] )