我无法将PHP变量传递给SQL查询

Question

我的密码在下面。我尝试使用PHP创建一个登录表单。它不起作用，所以请纠正我。

<?php
    $mycon = mysql_connect('localhost', 'root', '');
    $db = mysql_select_db('data', $mycon);

    $_user = mysql_real_escape_string($_POST['user']);
    $_pass = mysql_real_escape_string($_POST['pass']);

    $qur = "select * from admin where username = '$_user' and password = '$_pass' ";

    $res = mysql_query($qur, $mycon);

    if (mysql_num_rows($res) > 0) {

    }
    else {
        header('Location:admin.php');
    }
?>

Answer 1

将<form>与方法POST与隐藏字段一起使用，如：

<?php
    if (isset($_POST['check'])) {
        $mycon = mysql_connect('localhost', 'root', '');
        $db = mysql_select_db('data', $mycon);

        $_user = mysql_real_escape_string($_POST['user']);
        $_pass = mysql_real_escape_string($_POST['pass']);

        $qur = "SELECT * from admin where username = '$_user' AND password = '$_pass' ";

        $res = mysql_query($qur, $mycon);

        if (mysql_num_rows($res) > 0) {

            //Your stuff here

        }
        else {
            header('Location:admin.php');
        }
    }
?>

<form role="form" method = "POST" action = "">

    Username:
        <input type = "text" name = "user">
    Password:
        <input type = "text"   name = "pass">
        <input type = "hidden" name = "check">
        <input type = "submit" name = "submit" value="submit">
</form>

不推荐使用MySQL函数。请切换到http://en.wikipedia.org/wiki/MySQLi或https://en.wikipedia.org/wiki/PHP#Development_and_community。

Answer 2

​

<?php
    $mycon = mysql_connect('localhost', 'root', '');
    $db = mysql_select_db('data', $mycon);

    $_user = mysql_real_escape_string($_POST['user']);
    $_pass = mysql_real_escape_string($_POST['pass']);

    $qur = "select * from admin where username = '".$_user."' and password = '".$_pass."'";

    $res = mysql_query($qur, $mycon);

    if (mysql_num_rows($res) > 0) {

    }
    else {
        header('Location:admin.php');
    }
?>

​

Answer 3

​

<?php
    $mycon = mysql_connect('localhost', 'root', '');
    $db = mysql_select_db('data', $mycon);

    $_user = mysql_real_escape_string($_POST['user']);

    $_pass = mysql_real_escape_string($_POST['pass']);


    $qur = "select * from `admin` where `username`='{$_user}' and `password` ='{$_pass}'";


    $res = mysql_query($qur, $mycon);

    if (mysql_num_rows($res) > 0) {

        //Here your code will work

    }
    else {

        //And here it will not work
        header('Location:admin.php');
    }
?>

​

不要忘记检查表的列名。