blocks|key|2677445|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|-4|4|5|6|B|7|@]|8|@]|9|$]]]|A|$]]

<h1>Overview</h1>
<h2>OOP vs Procedural <code>mysqli</code></h2>
Firstly, it's important to note that the difference between the two methods is the way in which you, as a developer, interact with them. They both use use OOP one just hides it behind a veil of procedural functions. In fact, you can mix and match:
<pre><code>// OOP
$query = $mysqli-&gt;query(&quot;SELECT * FROM table&quot;);
while( $row = $query-&gt;fetch_assoc()){
 print_r($row);
}

// Procedural
$query = mysqli_query($mysqli, &quot;SELECT * FROM table&quot;);
while( $row = mysqli_fetch_assoc($query)){
 print_r($row);
}

// Combined
$query = mysqli_query($mysqli, &quot;SELECT * FROM table&quot;);
while( $row = $query-&gt;fetch_assoc()){
 print_r($row);
}
</code></pre>
Secondly, reference your concern about having procedural and OOP in the same code: there's nothing wrong with this. In fact I would argue it's a good thing. Code should be maintained, optimised, and refactored; the process of which takes time and can be done in small chunks. Today you improve your registration system, tomorrow maybe the login(?), and by next year you'll have upgraded everything and be ready to start all over again with PHP 8.x!
The reality is that best practice, available functionality, etc. is constantly changing and your code should change to reflect this.
Having said all that Procedural vs OOP is a style choice. Use what you prefer - but know that if you use procedural you're making life slightly more difficult for yourself and anyone who inherits your code base.
<h2>Error handling</h2>
General
You initialise a whole bunch of individual error variables in the form <code>$errorName = &quot;&quot;;</code>. The problem here is that now you have to remember them all to use them! Additionally although you've initialised the variables you only &quot;set&quot; them later on, so what's the point?
If you must do it this way then I suggest you at least use an array so that all <code>errors</code> are grouped together and can be passed as a whole:
<pre><code>// Initialise the error array
$errors = [];

// Check username is present and add error message if necessary
if(!$username){
 $errors[] = &quot;Username required&quot;;
}

// Check for any errors
if(count($errors)){
 // Some errors were found...
} else {
 // Error free so far...
}
</code></pre>
Alternatively, if you're interested in learning more about OOP implement a basic error reporting class which you can re-use across your webpages.
MySQLi
You don't appear to have turned on error reporting for <code>mysqli</code>; which you should aim to do so that you can catch any errors/bugs down the road.
<h2>Prepared Statements</h2>
There's really no excuse not to be using prepared statements for SQL queries. There are a number of benefits for both security, simplicity, and readability: with very few downsides.
<pre><code>$sql = &quot;SELECT * FROM user WHERE username = &quot; . sanitizeString($username) . &quot; AND status = &quot; . sanitizeInteger($status);

// Becomes...

$sql = &quot;SELECT * FROM user WHERE username = ? AND status = ?&quot;;
</code></pre>
It's a regular occurrence that people are advised to move toward <code>PDO</code> and ditch <code>mysqli</code> entirely as well; for comparison:
<pre><code>// Prepared statement with Procedural mysqli
$query = mysqli_prepare($mysqli, $sql);
mysqli_stmt_bind_param($query, &quot;si&quot;, $username, $status);
mysqli_stmt_execute($query);
$result = mysqli_stmt_get_result($query);
$row = mysqli_fetch_assoc($result);

// Preapred statement with OOP mysqli
$query = $mysqli-&gt;prepare($sql);
$query-&gt;bind_param(&quot;si&quot;, $username, $status);
$query-&gt;execute();
$result = $query-&gt;get_result();
$row = $result-&gt;fetch_assoc();

// Prepared statement with PDO
$query = $pdo-&gt;prepare($sql);
$query-&gt;execute([$username, $status]);
$row = $query-&gt;fetch(PDO::FETCH_ASSOC);
</code></pre>
Again, there's no harm in having <code>PDO</code> and <code>mysqli</code> in the same code... Eventually you'll refactor all of the code and it will be uniform.
Changing from one to the other doesn't take as long as you might think either. A number of the methods are similarly named: after all, for a query/result to work, with any method, you have to input and output the same information.
<h2>Misc. Points</h2>
Typos
You have an error in one of your variable names:
<pre><code> $createrAccount = signupform_input($_POST[&quot;creatorAccount&quot;]);
 ^
</code></pre>
Code formatting
At first glance your generous use of <code>if</code> statements look as though they are all nested inside one another... They aren't, but having the braces <code>{}</code> positioned as you do just makes it a bit awkward to read, stick to the standard:
<pre><code>if (condition) {
 // Do something...
} elseif (condition) {
 // Do something else...
} else {
 // Do something else...
}
</code></pre>
You have a few really long lines in your code... This makes it confusing to read, especially if the lines break at non-optimal places. You might consider intentionaly breaking lines to make it clearer:
<pre><code>INSERT INTO `users` (`username`, `password`, `plan`, `creatorPlan`) VALUES ('&quot;. mysqli_real_escape_string($link, $_POST['username']).&quot;', '&quot;. mysqli_real_escape_string($link, $hash).&quot;', '&quot;. mysqli_real_escape_string($link, $insertPlan).&quot;', '&quot;. mysqli_real_escape_string($link, $one).&quot;')

// Becomes...

INSERT INTO `users`
 (`username`, `password`, `plan`, `creatorPlan`)
VALUES (
 '&quot;. mysqli_real_escape_string($link, $_POST['username']).&quot;',
 '&quot;. mysqli_real_escape_string($link, $hash).&quot;',
 '&quot;. mysqli_real_escape_string($link, $insertPlan).&quot;',
 '&quot;. mysqli_real_escape_string($link, $one).&quot;'
)
</code></pre>
Code Placement
It is almost always preferred to have your functions defined at the top of the document. If you define them somewhere in the middle of the document they get lost. I, for instance, had no idea what <code>signupform_input</code> did until stumbling across it.
Variable names
<code>$one</code> what is that? Aside from the fact that you set it to <code>1</code> I have absolutely no idea!
It's good practice to make your variable and function names meaningful: ideally so that other people (and yourself when you come back to the code in a couple of months) understand what they do/contain/mean wihtout having to try and figure out the code or looking around the document. In your case names like <code>$username</code> and <code>$password</code> are obvious but names like <code>$link</code> can be ambiguous. Much better to use names which makes it clear what they are to anyone reading the code. For example:
<pre><code>$link &gt;&gt;&gt; $mysqli // Because it's a mysqli object
signupform_input(...) &gt;&gt;&gt; sanitizeInput(...) // Because the function sanitizes the input
</code></pre>
Bringing this briefly back to errors: you have named a whole bunch of errors reasonably well (<code>$usernameError</code>, <code>$termsandcontitionsError</code>) and then you have a random <code>$error</code>. To me that looks like a general error condition but in reality it is actually there to note when the username already exists in the database. Changing it's name would make that much clearer.
Other than that you should be aware that you re-use a few variable names. Especially when it come to queries and result sets. There's potential for confusion here and, if the code were more entangled/complex, there's the possibility you could overwrite something prematurely. If the bland names (e.g. <code>$query</code> and <code>$result</code>) were inside of a function then it doesn't matter so much (assuming they're used once only) because readers are already aware of scope; but having multiple occurrences and overwrites in any one body of code is not a good idea.
<hr />
<h1>Updates and Changes</h1>
<h2>Redundant Code</h2>
There is a significant percentage of your code that, well, doesn't seem to do anything or is repeated later in the code...
This query just executes and does nothing with the result set:
<pre><code>$query = &quot;SELECT * FROM `users`&quot;;

if($result = mysqli_query($link, $query)) {

 $row = mysqli_fetch_array($result);

}
</code></pre>
Anything to do with <code>$creatorAccount</code>, <code>$payment</code> &amp; <code>$signupButton</code> is halted after the input is sanitized. Which means the related errors are also, kind of, pointless?
Terms and Conditions has a few variables (including error variables) and <code>if</code> statements but it never actually does anything: the code never actually checks whether T&amp;C are set.
Every sigle input is sanitized with <code>signupform_input</code> at least twice, for example:
<pre><code>if(isset($_POST['username'])) {
 $username = signupform_input($_POST[&quot;username&quot;]); 
}


// And...

if (empty($_POST[&quot;username&quot;])) {
 $usernameError = &quot;Username is required.&quot;;
 echo $usernameError;
} else {
 $username = signupform_input($_POST[&quot;username&quot;]);
}
</code></pre>
Additionally, you don't actually use the sanitized <code>$username</code> in either of your queries! You put it through mysqli's escape function instead.
<pre><code>mysqli_real_escape_string($link, $_POST['username'])
</code></pre>
You don't need to use a <code>LIMIT</code> in your query when you simply are checking if there are any records. Not least becasue there should only ever be a maximum of one match.
There's no need to check the <code>REQUEST_METHOD</code> because you explicitly get the <code>POST</code> variables. There's definitely no need to check it twice!
I'm not sure (but concerned) with regards to what <code>$_POST[&quot;loginActive&quot;]</code> is actually referencing? If it's checking that the user is logged on, shouldn't that be some <code>SESSION</code> variable anyway?
Your banks of <code>if</code> statements can largely be reduced or removed entirely:
<pre><code>if(isset($_POST['username'])) {
 $username = signupform_input($_POST[&quot;username&quot;]); 
}

// Becomes...

$username = signupform_input($_POST[&quot;username&quot;] ?? null);
</code></pre>
Some of your larger <code>if</code> statements just aren't needed. For example:
<pre><code>if(isset($_POST['loginActive'])) // Is basically (or could be) redone in the next line of code

if ($_SERVER[&quot;REQUEST_METHOD&quot;] == &quot;POST&quot;) // As already covered
</code></pre>
I'm not sure what the point in having <code>$password</code>, <code>$updatePassword</code>, and <code>$hash</code> is?
Your comparisons are odd. You frequently use the <code>==</code> comparison operator in your <code>if</code> statements. Nothing wrong with that; however, you then do things like:
<pre><code>$_POST['loginActive'] == &quot;0&quot; &amp;&amp; $usernameError == &quot;&quot;

// However, that is effectively the same thing...

&quot;&quot; == &quot;0&quot; == 0 == false == null

// You may as well just do...

!$_POST['loginActive'] &amp;&amp; !$usernameError
</code></pre>
<h2>Missing Code</h2>
Data Validation
I would suggest that you should be scrapping your function <code>signupform_input</code> for a few reasons:
<ol>
<li>We don't want to inadvertently edit people's passwords
<ul>
<li>John always starts and finishes his password with a <code>space</code>; now his password is 2 characters shorter!</li>
<li>Sophie uses a random password generator which includes <code>\</code>; now her password is shorter as well!</li>
<li>Bear in mind that if you edit the password on registration you then have to be certain to do the same edits on loin as well. If you don't Sophie and John won't be able to log on!</li>
</ul>
</li>
<li>It is typical for sanitizing functions like <code>htmlspecialchars</code> to be carried out on output and the raw data be stored in the database</li>
<li>The function is solely about sanitizing data and not validating it</li>
</ol>
However, you should implement a couple of new functions
<ol>
<li>To validate the username
<ul>
<li>For example: to make sure it only contains letters and numbers (or whatever characters you so allow)</li>
</ul>
</li>
<li>To validate the password
<ul>
<li>For example: to make sure that it is 8 characters long and contains at least one number and one letter etc.</li>
</ul>
</li>
</ol>
mysqli Error Reporting
You should add error reporting for <code>mysqli</code> so that you catch and report errors that occur in an appropriate manner:
<pre><code>mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
</code></pre>
<hr />
<h1>Updated Code</h1>
<h2>Notes</h2>
I'm not 100% sure on a few aspects of your so bear in mind:
<ol>
<li><code>$_POST[&quot;loginActive&quot;]</code>
<ul>
<li>I'm not sure what this is and am a little worried it's some kind of &quot;I'm logged on&quot; marker?</li>
<li>Have removed from the below code for the time being...</li>
</ul>
</li>
<li><code>$_POST[&quot;termsandconditions&quot;]</code>
<ul>
<li>I assume this returns a <code>1</code> if it has been checked?</li>
</ul>
</li>
<li>Any other code highlighted earlier to be redundant has been removed</li>
<li>Some basic rules for username and password validation have been incorporated</li>
<li>The below code uses OOP methodology</li>
<li>Error messages are printed after the execution of the code, not during.</li>
<li>The validation functions are deliberately simple - I don't know what your rules are</li>
<li>I've added an anonymous class to handle error reporting; it's something you can expand on should you so wish.</li>
<li>The logic below consists of approximately half the lines of code of the original
<ul>
<li>Not including the functions and class: because they are new functionality</li>
</ul>
</li>
</ol>
<h2>Code</h2>
Disclaimer: Please note that this code is untested
<pre><code>&lt;?

session_start();
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
$mysqli = new mysqli(&quot;****&quot;, &quot;****&quot;, &quot;****&quot;, &quot;****&quot;);


$error = new class {
 public array $active = [];

 private array $message = [
 &quot;usernameRequired&quot; =&gt; &quot;Username is required.&quot;,
 &quot;usernameTaken&quot; =&gt; &quot;That username is already taken.&quot;,
 &quot;passwordRequired&quot; =&gt; &quot;Password is required.&quot;,
 &quot;termsRequired&quot; =&gt; &quot;You must accept the T&amp;Cs to create an account&quot;,
 ];

 public function count() : int
 {
 return count($this-&gt;active);
 }
 
 public function throw($messageid) : void
 {
 $this-&gt;active[] = $this-&gt;message[$messageid];
 }

 public function __toString() : string
 {
 $errorMessages = '';
 foreach($this-&gt;active as $error){
 $errorMessages .= $error . &quot;&lt;br&gt;&quot;;
 }
 return $errorMessages;
 }
};

function validateUsername(?string $username) : ?string
{
 return preg_match(&quot;/^\w+$/&quot;, $username) ? $username : null;
}

function validatePassword(?string $password) : ?string
{
 return preg_match(
 &quot;
 /
 (?=.*[a-z])
 (?=.*[A-Z])
 (?=.*[0-9])
 (?=.*[!£$%&amp;@#])
 ^(.{8,})$
 /x
 &quot;, $password
 ) ? password_hash($password, PASSWORD_DEFAULT) : null;
}

$username = validateUsername($_POST[&quot;username&quot;] ?? null);
$password = validatePassword($_POST[&quot;password&quot;] ?? null); 
$terms = (int) ($_POST[&quot;termsandconditions&quot;] ?? null);

$insertPlan = $_SESSION['playerPlan'] ?? null;
$creatorPlan = 1;

if (!$username) {
 $error-&gt;throw(&quot;usernameRequired&quot;);
}
if (!$password) {
 $error-&gt;throw(&quot;passwordRequired&quot;);
}
if ($terms !== 1) {
 $error-&gt;throw(&quot;termsRequired&quot;);
}

if ($error-&gt;count() === 0) {
 $usernameSql = &quot;
 SELECT *
 FROM users 
 WHERE username = ?
 &quot;;
 $usernameQuery = $mysqli-&gt;prepare($usernameSql);
 $usernameQuery-&gt;bind_param(&quot;s&quot;, $username);
 $usernameQuery-&gt;execute();
 $usernameQuery-&gt;store_result();

 if ($query-&gt;num_rows) {
 $error-&gt;throw(&quot;usernameTaken&quot;);
 } else {
 $insertSql = &quot;
 INSERT INTO users
 (username, password, plan, creatorPlan)
 VALUES 
 (?, ?, ?, ?)
 &quot;;
 $insertQuery = $mysqli-&gt;prepare($insertSql);
 $insertQuery-&gt;bind_param(&quot;ssss&quot;, $username, $password, $insertPlan, $creatorPlan);
 $insertQuery-&gt;execute();
 $_SESSION['id'] = $mysqli-&gt;insert_id ?? null;
 echo &quot;Success!&quot;;
 }
}

// Output any errors
echo $error;
</code></pre>

My script works but I just want to know how I can protect myself from SQL injection with Procedural Oriented MySQLi. Most of the tutorials are about Object-Oriented MySQLi and I'm not familiar with it and don't want to have both Procedural and OO MySQLi in the same script. I have a lot more PHP files. I also do know how to protect against SQL injections but not with procedural style. I know that OO is more useful and A LOT better but as I said I'm not familiar with it. Any help would be appreciated but preferably Procedural Oriented MySQLi.
PHP
<pre><code>&lt;?php 
 session_start();
 $link = mysqli_connect(&quot;****&quot;, &quot;****&quot;, &quot;****&quot;, &quot;****&quot;);
 
 
 if(mysqli_connect_error()) {
 
 die(&quot;Couldn't connect to the database. try again later.&quot;);
 
 } 
 
 $query = &quot;SELECT * FROM `users`&quot;;

 if($result = mysqli_query($link, $query)) {
 
 $row = mysqli_fetch_array($result);
 
 }

 $signupButton = &quot;&quot;;
 $username = &quot;&quot;;
 $password = &quot;&quot;;
 $termsandconditions = &quot;&quot;;
 $payment = &quot;&quot;;
 $creatorAccount = &quot;&quot;;
 
 if ($_SERVER[&quot;REQUEST_METHOD&quot;] == &quot;POST&quot;) {
 if(isset($_POST['username'])) {
 $username = signupform_input($_POST[&quot;username&quot;]); }
 
 if(isset($_POST['password'])) {
 $password = signupform_input($_POST[&quot;password&quot;]); }
 
 if(isset($_POST['signupButton'])) {
 $signupButton = signupform_input($_POST[&quot;signupButton&quot;]); }
 
 if(isset($_POST['termsandconditions'])) {
 $termsandconditions = signupform_input($_POST[&quot;termsandconditions&quot;]); }
 
 if(isset($_POST['payment'])) {
 $payment = signupform_input($_POST[&quot;payment&quot;]); }
 
 if(isset($_POST['creatorAccount'])) {
 $createrAccount = signupform_input($_POST[&quot;creatorAccount&quot;]); }
 }

 function signupform_input($data) {
 $data = trim($data);
 $data = stripslashes($data);
 $data = htmlspecialchars($data);
 return $data;
 }
 

 $usernameError = &quot;&quot;;
 $passwordError = &quot;&quot;;
 $termsandconditionsError = &quot;&quot;;
 $error = &quot;&quot;;
 $insertPlan = &quot;&quot;;
 $updatePassword = &quot;&quot;;
 $hash = &quot;&quot;;
 $one = &quot;&quot;;
 $paymentError = &quot;&quot;;
 if ($_SERVER[&quot;REQUEST_METHOD&quot;] == &quot;POST&quot;) {
 
 if (empty($_POST[&quot;username&quot;])) {
 $usernameError = &quot;Username is required.&quot;;
 echo $usernameError;
 } else {
 $username = signupform_input($_POST[&quot;username&quot;]);
 }
 if (empty($_POST[&quot;password&quot;])) {
 $passwordError = &quot; Password is required.&quot;;
 echo $passwordError;
 } else {
 $password = signupform_input($_POST[&quot;password&quot;]);
 $updatePassword = signupform_input($_POST[&quot;password&quot;]);
 }
 
 if(isset($_POST['loginActive'])) {
 if($_POST['loginActive'] == &quot;0&quot; &amp;&amp; $usernameError == &quot;&quot; &amp;&amp; $passwordError == &quot;&quot; &amp;&amp; $termsandconditionsError == &quot;&quot;) {
 
 $query = &quot;SELECT * FROM users WHERE BINARY username = '&quot;. mysqli_real_escape_string($link, $_POST['username']).&quot;' LIMIT 1&quot;; 
 $result = mysqli_query($link, $query);
 if(mysqli_num_rows($result) &gt; 0) {
 
 $error = &quot;That username is already taken.&quot;;
 echo $error;
 } else {
 $one = &quot;1&quot;;
 $hash = password_hash($updatePassword, PASSWORD_DEFAULT);
 $insertPlan = $_SESSION['playerPlan'];
 echo &quot;&lt;p style='color: green'&gt;Hi&lt;/p&gt;&quot;;
 $query = &quot;INSERT INTO `users` (`username`, `password`, `plan`, `creatorPlan`) VALUES ('&quot;. mysqli_real_escape_string($link, $_POST['username']).&quot;', '&quot;. mysqli_real_escape_string($link, $hash).&quot;', '&quot;. mysqli_real_escape_string($link, $insertPlan).&quot;', '&quot;. mysqli_real_escape_string($link, $one).&quot;')&quot;;
 mysqli_query($link, $query);
 $_SESSION['id'] = mysqli_insert_id($link);
 
 
 } 
 } 
 }
 } 
 
?&gt;
</code></pre>

My Script Inserts users into a database and hashes the password, I need to know how to prevent SQL injection with Procedural-Oriented MySQLi

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我的脚本可以工作，但我只想知道如何使用面向过程的MySQLi保护自己不受SQL注入的影响。大多数教程都是关于面向对象的MySQLi的，我对它并不熟悉，我不想在同一个脚本中同时使用过程和面向对象的MySQLi。我有很多PHP文件。我也知道如何防范SQL注入，但不是用过程风格。我知道OO更有用，也更好，但正如我所说，我对它并不熟悉。任何帮助都将不胜感激，但最好是面向过程的MySQLi。PHP 0) {

问我的脚本将用户插入数据库并对密码进行散列，我需要知道如何使用面向过程的MySQLi防止SQL注入。
EN

回答 1

Code Review用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我的脚本将用户插入数据库并对密码进行散列，我需要知道如何使用面向过程的MySQLi防止SQL注入。EN