php - 向mysql插入数据不起作用

Question

 <? 
session_start();


 if(($connection = mysql_connect("localhost", "root", "")) == false)
  die ("Couldn't connect to database");

 if(mysql_select_db("Social", $connection) == false)
   die ("Couldn't select db");

 if (isset($_POST['username']) && isset($_POST['pass']) && isset($_POST['login'])){

$sql = sprintf("SELECT * FROM users WHERE username LIKE '%s' AND password LIKE '%s'", $_POST['username'],  $_POST['pass']);
$query = mysql_query($sql);

if (mysql_num_rows($query) == 0){

$error = "<br />Wrong Username or Password";}

 else{
 $_SESSION['user'] = $_POST['username'];
 header("Location: home1.php");
       }
    }


if (isset($_POST['register'])){

         $sql2 = sprintf("INSERT INTO Social.users (username, password) VALUES   (%s, %s)", $_POST['newUser'], $_POST['newPass']);
         $query2 = mysql_query($sql2);

     if (!$query2){
        print "Registration failed";
     }
     else{
    print "Registration sucessfull";
    }
}

?>

我的程序没有将任何数据插入 mySQL 表中。我知道所有语法都是正确的，一切都应该很好。我仔细检查了 mySQL 用于将数据输入表中的命令。为什么这不起作用？我的 query2 应该会成功，但我不知道为什么不成功。请帮忙。谢谢

Answer 1

要防止sql注入(inject)，请尝试mysqli或pdo

这里是 mysqli 准备好的语句版本。但是，如果您尝试创建用户管理系统，我不建议您这样做。有很多脚本可以提供更高的安全性，http://www.usercake.com是一个很好的用户管理系统。

 session_start();
$db = new mysqli('localhost', 'root', 'password', 'database');

 if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

 if (isset($_POST['username'] && $_POST['pass'] && $_POST['login']))
 {
 $user_name = ''; //define these here. 
 $pass = '';

 $stmt = $db->prepare("select * from users where username = ? and password = ?");
 echo $db->error;//this will echo the error.
 $stmt->bind_param('ss', $user_name, $pass);
 $stmt->execute();
 $result = $stmt->get_result();//get rows

 if($result->num_rows < 1) //check if result is less than 1
{
$error = "<br />Wrong Username or Password";}

 else{
 $_SESSION['user'] = $_POST['username'];
 header("Location: home1.php");
}
}

if (isset($_POST['register'])){

$uname = $_POST['newUser'];
$pass = $_POST['newPass'];

if(empty($uname))
{
echo "Please enter your username.";
}
elseif(empty($pass))
{
echo "Please enter your password.";
}
else{
$stmt = $db->prepare("insert into Social.users (username, password) values (?,?)");
echo $db->error;//this will echo the error.
$stmt->bind_param('ss', $uname, $pass);
$stmt->execute();
echo "You have successfully registered.";
}
}