php - 使用PHP检查用户名是否存在于MySQL表中？

Question

这个问题在这里已经有了答案:





mysql_fetch_array()/mysql_fetch_assoc()/mysql_fetch_row()/mysql_num_rows etc... expects parameter 1 to be resource

(31 个回答)


6年前关闭。




我想创建一个代码来检查服务器上是否已经存在用户名或不使用 MySQL 和 PHP。代码:

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}
$sql = "SELECT username FROM Servers where email=".$user_info['email']."";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
//username exists
}
else
{
 //...
}

我不断收到此错误:

Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, boolean given in

Answer 1

您不想通过将用户输入连接到字符串来生成 SQL 查询。这可能导致 SQL injection .

你想parameterize您的查询。首先将查询的结构声明到 MySQL，然后绑定(bind)参数并调用它以获取结果。这就像使用一个函数:您很少使用用户输入动态生成它。将您的 SQL 查询视为函数。

// Create connection
$conn = mysqli_connect($servername, $username, $password, $dbname);
// Check connection
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}
$emailIsValid = false;
// Initialize a query. Note how we replaced the variable by a '?'. This indicates a parameter.
$sql = "SELECT username FROM Servers where email=?";
$query = mysqli_stmt_init($conn);
if (mysqli_stmt_prepare($query, $sql)){
    // Declare the user email as first parameter of the query
    mysqli_stmt_bind_param($query, "s", $user_info['email']);
    // Executes the query
    mysqli_stmt_execute($query);
    // Bind the result to a variable
    mysqli_stmt_bind_result($query, $result);
    // Read first result
    if(mysqli_stmt_fetch($query)){
        // At least one user, so the email exists
        $emailIsValid = true;
    }
    // If we don't need the query anymore, we remove it
    mysqli_stmt_close($query);
}

if ($emailIsValid) {
//username exists
}
else
{
 //...
}

查看 mysqli docs了解更多信息。虽然我建议你使用 PDO反而。