php - 使用 PHP 将一个 MySQL 语句转化为多个 PHP 变量

Question

关于我正在努力完成的事情的一些背景..

我正在制作一个简单的 CMS/博客，我正在尝试通过按用户名选择数据库的名字/姓氏值来自动创建签名。然后在选择它们之后，我试图将它们放入一个变量中

例子:

$firstname = row['firstname'];
$lastname = row['lastname'];

$signature = $firstname + " " + $lastname; 
echo 'Created by: ' . $signature;

以上是我在精神上试图实现的目标，但我似乎无法完全实现。这是我到目前为止所拥有的，我没有任何运气......

$username = $_SESSION['username'];

 $sqlName = "SELECT * FROM users WHERE username = $username";
 $connName->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$resultName = $connName->query($sqlName);

 foreach ($resultName as $row) {
    $firstname = $rowN['firstname'];
    $lastname = $rowName['lastname'];
}

这是我对那些想知道的人的最新演绎:

   $username = $_SESSION['username'];
$connName = new PDO('mysql:host=localhost;dbname=platform', 'tyler', 'H011mann');
 $connName->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

 $sqlName = "SELECT * FROM users WHERE username = $username";


$resultName = $connName->query($sqlName);
$name = 'Created by : ';
foreach ($resultName as $row) {
    $name .= $row['firstname'] . ' ' . $row['lastname'];
}
echo '<div>' . $name. '</div>';

Answer 1

您的代码存在一些问题。乍一看，我错过了 PDO 对象。仔细检查后，我注意到您使用了错误的串联运算符，而且您似乎也没有使用 Prepared Statements。

准备好的语句将保护您免受 SQL 注入(inject)以及使用可能导致 MySQL 数据库问题的字符的用户。我已经为您编写了以下代码来处理您的所有问题。请务必查看里面的评论:

<?php
session_start();

//Get Username
$username = $_SESSION['username'];

//MySQL Server Data
$dbhost = "";
$dbname = "";
$dbuser = "";
$dbpass = "";

//PDO Object
$dsn = 'mysql:host=' . $dbhost . ';dbname=' . $dbname;
// Set PDO options
$options = array(
    PDO::ATTR_PERSISTENT    => true,
    PDO::ATTR_ERRMODE       => PDO::ERRMODE_EXCEPTION
);
// Create a new PDO instance
try{
    $pdo = new PDO($dsn, $dbuser, $dbpass, $options);
}
// Catch any errors
catch(PDOException $e){
    print $e->getMessage();
    exit;
}

try {
    //Setup Query
    $sql = "SELECT * FROM users WHERE username = :username";

    //Prepare Query
    $pdo->prepare($sql);

    //Bind Values (to prevent SQL injection)
    $pdo->bindParam(':username', $username);

    //Execute Query
    $pdo->execute();

    //Fetch Data
    $data = $pdo->fetch(PDO::FETCH_ASSOC);

    //Combine results
    $signature = $data['firstname']. " " .$data['lastname'];
    echo $signature;
} catch (PDOException $e) {
    print $e->getMessage();
    exit;
}

?>