php - 如何在 php/mySql 中检索单个记录？

Question

我尝试返回包含以下语句的单个记录:

$username = $_POST["username"];
$con=mysqli_connect("localhost","root","pass","Testproject");

// Check connection
if (mysqli_connect_errno($con))
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }


$sql = mysqli_query($con,"SELECT * FROM registeredusers where Username=".$username);
  $row = mysqli_fetch_array($sql);

  if (!$row) {
    printf("Error: %s\n", mysqli_error($con));
    exit();
}

并且收到以下错误:

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given in "Filepath goes here"/AddEvent.php Error: Unknown column 'Tom' in 'where clause'

本例中的“Tom”是用户名。任何想法如何解决这一问题？我在 stackoverflow 上看过类似的问题，但其中大多数都有点复杂，或者不尝试获取单个记录。

编辑:我已将查询更改为以下内容:

  $sql = mysqli_query($con,"SELECT * FROM registeredusers") or die(mysqli_error($con));
  $row = mysqli_fetch_array($sql);

还添加了这个”

$row_cnt = $result->num_rows;
 printf("Result set has %d rows.\n", $row_cnt);

我得到以下信息:

"Result set has 0 rows".

我已在 DBMS 中输入了精确的查询，它返回了许多行。

Answer 1

您缺少 $username 的引号，因此容易受到 SQL 注入(inject)攻击。我建议你绑定(bind)变量，这样 MySQLi 就会进行引用并保护你免受 SQL 注入(inject):

$sql = "SELECT * FROM registeredusers where Username = ?";
if ($stmt = $con->prepare($sql)) {
    $stmt->bind_param('s', $username);
    $stmt->execute();
    $results = $stmt->get_result();
    $row = mysqli_fetch_array($results);
    var_dump($row);
}