PHP/MySQL mysql_num_rows 不返回值

Question

我是 PHP 和一般编程的新手，但正在努力进行登录。我已经完成了注册页面，并且我的数据库可以很好地填充记录。但是，当输出此代码时，它说我有 0 行来自 mysql_num_rows($result);... 当我输入正确的用户名/密码时，它应该成功返回并显示 1 行。无论我是否输入了成功的用户/密码组合，它的输出都是一样的。

感谢您提供的任何帮助，代码如下:

$SQL = "SELECT * FROM account WHERE username = $username AND password = md5($password)";
            $result = mysql_query($SQL);
            $num_rows = mysql_num_rows($result);
            echo $result;
            echo $num_rows;

            // CLOSE CONNECTION
            mysql_close($db_handle);

            // COMPARE $num_rows TO SEE IF A SUCCESSFUL LOGIN, THEN DIRECT TO MEMBERS PAGE

            if ($result) {
                if ($num_rows > 0) {
                    session_start();
                    $_SESSION['login'] = "1";
                    header ("Location: page1.php");
                }   
                    else {
                        $error_message = "Login failed.  Please try again.";
                        echo $num_rows;

Answer 1

编辑:完成重写

试试这个:

<?php



$host = "host";
$user = "user";
$password = "password";
$database = "database";


$username = 'jack'; /* Insert $_Post [''] here with username variable you pass. You could sanitize and validate with for example filter_var (), clean (), etc */
$password_user = 'password from jack'; // same here.

$link = mysqli_connect($host, $user, $password, $database);
        IF (!$link){
        echo ("Unable to connect to database!");
        }

        ELSE{
$query = "SELECT * FROM account WHERE username ='$username' AND password = md5('$password_user')";
            $result = mysqli_query($link, $query);
            $num_rows = mysqli_num_rows($result);
            $row = mysqli_fetch_array($result, MYSQLI_BOTH);

            // COMPARE $num_rows TO SEE IF A SUCCESSFUL LOGIN, THEN DIRECT TO MEMBERS PAGE

            if ($row) {
                    session_start();
                    $_SESSION['login'] = "1"; // pleae not that 1 is converted into a string value
                    $_SESSION['username'] = $username; // added username, just to test.
                    header ("Location: page1.php");
                }   
                    else {
                        $error_message = "Login failed.  Please try again.";
                        echo $error_message;
                    }
            // CLOSE CONNECTION
            mysqli_close($link);            
        }
?>

示例数据:

CREATE TABLE account (
  id INT auto_increment primary key,
  username VARCHAR(30),
  password VARCHAR(50)
  );


INSERT INTO account(username, password)
VALUES 
("bob", md5('password from bob')), 
("jack", md5('password from jack')), 
('joe', md5('password from joe'));

SQL FIDDLE DEMO

示例页面 1

<?php
session_start();
$login = $_SESSION['login'];
$username = $_SESSION['username'];

echo '<h1>It WORKS, <i>'.$username.'</i>!!!</h1>';


?>

需要注意的是，我使用的是 MYSQLI 库，而不是 MYSQL 库。如果您的表格中有多于一列，您应该选择每列的输出。例如，$result['id']。

我发现你在SQL语句中并没有对变量in和out进行转义。我必须指出，我没有调试下面的部分比较 $num_rows 以查看是否成功登录，然后直接发送给成员。我认为您可以自行管理。

W.R.T.您必须做更多工作的 sanitizer 和验证。我不知道您的数据是如何通过用户登录表单传递过去的。假设您将使用 POST。在这种情况下，您可以从页面顶部开始，首先使用 $_POST 检索所有已发布的变量。然后过滤它们以确保您输入的代码不对 SQL 注入(inject)开放。例如。 $username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);