php - mysql num rows 返回 0

Question

我已经检查了所有变量。它们都包含正确的数据。但是，当我调用 mysql_num_rows() 时，它返回 NULL，而不是 1。因此，我的登录脚本显示错误的用户名和密码，而实际上它们是正确的。

<?php
ini_set('display_errors', 'On');
error_reporting(E_ALL | E_STRICT);

ob_start();
$host="mywebsite.it"; // Host name
$username="whateveruser"; // Mysql username
$password="whateverpassword"; // Mysql password
$db_name="whateverdb"; // Database name
$tbl_name="whatevertable"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
print "$db_name\n";/*These is correct*/
print "$tbl_name\n";/*These is correct*/
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];


/*To protect MySQL injection*/
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
print "\n$result"; /*These is correct*/
// Mysql_num_row is counting table row
$count = mysql_num_rows($result); /*This isn't actually returning 1*/
echo '<pre>'; var_dump($count); echo '</pre>';


// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("Location:Target.php");
}
else {

echo "Wrong Username or Password";    /*my script always goes here*/
}

ob_end_flush();
?>

Answer 1

这看起来应该可行。但是，请停止使用 mysql_* 函数。它们已被弃用，并且存在许多安全问题。

相反，我强烈建议您使用支持 native 编码的库，例如 PDO。 ( http://www.php.net/manual/en/class.pdo.php ) 具体来说，我建议您使用准备好的语句。 (http://www.php.net/manual/en/pdo.prepare.php)

我在下面提供了一个简单的示例。

这里有一个快速连接功能:

<?php

function connectToDb($dbms, $host, $port, $username, $password) {
    $dsn = sprintf('%s:host=%s;port=%d', $dbms, $host, $port);

    $attributes = array(
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
    );  

    // Wrap PDO instantiation in a try->catch so credentials don't end up in
    // stack traces

    try {
        $connection = new PDO(
            $dsn, $username, $password, $attributes
        );  
    } catch (Exception $exception) {
        throw new Exception($exception->getMessage());
    }   

    return $connection;
}

以下是如何使用它的快速示例:

// Connect to the database

$connection = connectToDb(
    'mysql', 'localhost', '3306', 'bryan', ''
);

// Prepare the statement with parameters we can bind user input to
// These parameters will be properyly encoded to prevent SQL injection

$statement = $connection->prepare(
    'SELECT user,password FROM mysql.user WHERE user = :username'
);

// Perform the search with the user-supplied data
// We'll pretend here with $usernameSearch 

$usernameSearch = 'bryan';

$statement->execute(
    array(':username' => $usernameSearch)
);

// Get the result set row count

$rowCount = $statement->rowCount();

// Do What you need to do

if ($rowCount > 0) {
    // Fetch a row
    $result = $statement->fetch(PDO::FETCH_ASSOC);
    printf("Found a record for %s!\n", $result['user']);
} else {
    echo "No record found!\n";
}