php - mysqli_real_escape_string() 中出错？

Question

这个问题已经有答案了:

mysqli::query(): Couldn't fetch mysqli (4 个回答)

已关闭 6 年前。

在这里，我正在创建注册新用户表单，但我在mysql_real_escape_string()中遇到了问题.so，我使用了替代方案mysqli_real_escape_string()我尝试过

mysqli_real_escape_string($conn,$_POST['user_name'])

但没有工作。在这里，我创建了一个单独的 connect.php(用于与服务器和数据库的连接)文件以节省我的时间，并且我已使用

include 'connect.php';

我不确定是否制作单独的 connect.php 文件 mysqli_real_escape_string($conn,$_POST['user_name'])可以用也可以不用。

connect.php

<?php
    $server='localhost';
    $username='root';
    $password='';
    $db_name='web_forum_db';

    if(!$conn=mysqli_connect($server,$username,$password))
    {
        exit('Error: could not establish database connection');
    }

    if (!mysqli_select_db($conn,$db_name))
     {
        exit('Error: could not select the database');
    }
    mysqli_close($conn);
?>

<小时/>

signup.php

<?php
    include 'connect.php';
    include 'header.php';
    echo '<h3>Sign up</h3>';
    if($_SERVER['REQUEST_METHOD'] !='POST')
    {
        echo '<form method="POST" action="">
        Username:<input type="text" name="user_name"/>
        Password: <input type="password" name="user_pass">
        Password again:<input type="password" name="user_pass_check">
        E-mail:<input type="email" name="user_email">
        <input type="submit" value="Add category"/>
        </form>';
    }
    else
    {
        $errors = array();/*declare the array for later use*/
        if(isset($_POST['user_name']))
        {
            //the user name exists
            if (!ctype_alnum($_POST['user_name'])) {
                $errors[]='The username can only contain letters and digits.';
            }

            if(strlen($_POST['user_name'])>30)
            {
                $errors[]='The username cannot be longer than 30 characters.';
            }
        }
        else
        {
            $errors[]='The username field must not be empty.';
        }
        if(isset($_POST['user_pass']))
        {
            if($_POST['user_pass'] !=$_POST['user_pass_check'])
            {
                $errors[]='The two passwords did not match.';
            }
        }
        else
        {
            $errors[]='The password field cannot be empty.';
        }
        if (!empty($errors))/*check for  an empty array, if there are errors, they`re in this array*/ {
            echo 'Uh-oh.. a couple of fields are not filled in correctly..';
            echo '<ul>';
            foreach ($errors as $key => $value)/*walk through the array so all the errors get displayed*/
             {
                echo '<li>' . $value. '</li>';/*This generates a nice error list*/
            }
            echo '</ul>';
        }
        else
        {
            $sql = "INSERT INTO users(user_name,user_pass,user_email,user_date,user_level) VALUES('".mysqli_real_escape_string($conn,$_POST['user_name'])."',
            '".sha1($_POST['user_pass'])."',
            '".mysqli_real_escape_string($conn,$_POST['user_email'])."',
            NOW(),0)";
            $result=mysqli_query($conn,$sql);

            if(!$result)
            {
                //something went wrong, display the error

                echo 'Something went wrong while registering. Please try again later.';
                //echo mysql_error(); //debugging purposes, uncomment when needed
            }
            else
            {
                echo 'Successfully registered. You can now <a href="signin.php">sign in </a> and start posting! :-)';
            }

        }
    }
    include 'footer.php';
?>

<小时/>

显示的错误:

Warning: mysqli_real_escape_string(): Couldn't fetch mysqli in C:\xampp\htdocs\web_forum\signup.php on line 56

Warning: sha1() expects parameter 1 to be string, object given in C:\xampp\htdocs\web_forum\signup.php on line 57

Warning: mysqli_real_escape_string(): Couldn't fetch mysqli in C:\xampp\htdocs\web_forum\signup.php on line 58

Warning: mysqli_query(): Couldn't fetch mysqli in C:\xampp\htdocs\web_forum\signup.php on line 60

以下代码位于第 56、57、58 和 60 行:

$sql = "INSERT INTO users(user_name,user_pass,user_email,user_date,user_level) VALUES('".mysqli_real_escape_string($conn,$_POST['user_name'])."',
            '".sha1($_POST['user_pass'])."',
            '".mysqli_real_escape_string($conn,$_POST['user_email'])."',
            NOW(),0)";
            $result=mysqli_query($conn,$sql);

Answer 1

您将在建立 mysqli 连接后立即关闭它。

只需从 connect.php 中删除此行:

mysqli_close($conn);

但无论如何，正如 Jens 所说，您应该使用准备好的语句而不是 mysqli_real_escape_query。