php - mysql_num_rows() 返回零

Question

<form action = "index.php" method = "post">
username : <input type = "text" name = "uname" /><br>
password : <input type = "text" name = "pass" /><br>
submit : <input type = "submit" name = "submit" value = "submit" />
</form>

<?php
if(isset($_SESSION['id'])){echo $_SESSION['id'];}
if(isset($_POST['submit'])){
if ($_POST['submit'] == 'submit'){

$uname = $_POST['uname'];
$pass = $_POST['pass'];
$db = "davidedwardcakes";
$connect = mysql_connect('localhost', 'root', 'wtfiwwu');
$db_connect = mysql_selectdb($db, $connect);
if(!$db_connect){echo 'no';}

$query = "SELECT * FROM `users` WHERE uname ='$uname' AND pass = '$pass'";
$result = mysql_query($query, $connect);
if(mysql_num_rows($result) > 0){//echo 'index failed'; var_dump($result);}
while($row = mysql_fetch_array($result)){echo $row['uname']
 . "<br>";

session_start();
echo '<a href = "test.php">peruse</a>';
$_SESSION['id'] = $row['id'];}}

else{echo 'lol'; var_dump($query);}}

每当我想登录时，我都会收到错误: 字符串 'SELECT * FROM users WHERE uname ='brown' AND pass = 'kenji'' (length=61)

这意味着我的 $query 有问题。如果我从 $query 中删除 $pass 查询，它可以正常工作，但在包含它时则不行。有人可以帮忙吗？

Answer 1

您的查询没有任何问题，但您的错误报告有问题。例如，以下行:

if(mysql_num_rows($result) > 0){//echo 'index failed'; var_dump($result);}

当 SQL 查询返回至少 1 行时，将转储 $result 变量。也许您想使用:

if(mysql_num_rows($result) < 1) { echo 'index failed'; var_dump($result); }

此外，还有一些注意事项:

1. 不要将密码存储为纯文本。 http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/
2. 不要使用mysql_*函数；它们已被弃用。看PDO或MySQLi 。
3. 您的代码对 SQL injection 开放.