PHP、PDO、MySQLi 函数不插入到数据库

Question

我编写了使用 pdo 将信息插入数据库并获得 XSS 保护的代码。现在我看了几天代码，没有看到使代码无法插入所需信息的问题。这是我的代码:

if ($register = $mysqli->prepare("INSERT INTO `accounts`(`id`, `username`, `email`, `password`, `salt`, `fullname`, `birthdate`, `gender`, `secure question`, `secure answer`, `asked`, `answered`, `lastlogin`) VALUES (NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
                    $register->bind_param("ssssssddsdds", $username, $email, $password, $random_salt, $fullname, $birthdate, $gender, $question, $answer, $z, $z, $lastlogin);
                    // Execute the prepared query.
                    if (! $register->execute()) {
                        echo "אירעה שגיאה";
                        $register->close();
                    }else{
                    echo 'אתם נרשמתם בהצלחה!. לחצו <a href="http://shaloti.com/users/login/">כאן</a>';}
                    $register->close();
                }

以及连接代码:

$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

谢谢。

Answer 1

使用mysqli_affected_rows获取插入的行数，如果任何函数失败，使用mysqli_error检查错误

$sql = "INSERT INTO `accounts`(`id`, `username`, `email`, `password`, `salt`, `fullname`, `birthdate`, `gender`, `secure question`, `secure answer`, `asked`, `answered`, `lastlogin`) VALUES (NULL, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
if ($register = $mysqli->prepare($sql)) {
    $register->bind_param("ssssssddsdds", $username, $email, $password, $random_salt, $fullname, $birthdate, $gender, $question, $answer, $z, $z, $lastlogin);
    // Execute the prepared query.
    if (!$register->execute()) {
        echo "אירעה שגיאה";
        die("execute() failed: ". mysqli_error($mysqli));
    }

    if(mysqli_affected_rows($register) > 0){
        echo 'אתם נרשמתם בהצלחה!. לחצו <a href="http://shaloti.com/users/login/">כאן</a>';
    }else{
        echo 'Did not inser any row';
    }
}else{
    die("prepare() failed: ". mysqli_error($mysqli));
}