php - 从查询中得不到结果

Question

我想显示登录我网站的人的名字。这是我网站的一个页面中包含的 login.php 文件的代码。

<?php

$connect = mysql_connect("localhost","root","") or die("Error");
mysql_select_db("jpnv_db") or die("Couldn't find db");

function login() {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $query = mysql_query("SELECT * FROM customers WHERE `username`='$username' AND `password`='$password'");
    $names = mysql_query("SELECT contactFirstName FROM customers WHERE `username`='$username'");

    if (empty($username)) {
        $errors[] = 'Please fill in your username. <a href="index.php">Click here to try again.</a>';
    }

    if (empty($password)) {
        $errors[] = 'Please fill in your password. <a href="index.php">Click here to try again.</a>';
    }    

    if ($errors==true) {
        foreach ($errors as $error) {
            echo $error.'<br />';
        }
    } else {
        if (mysql_num_rows($query)==true) {
            echo $names['customers'];
        } else {
            echo 'Your username and/or password are incorrect. <a href="index.php">Click here to try again.</a>';
        }
    }
}
?>

这是密码不正确时的结果:

这是我实际登录成功后的结果:

如您在我的代码中所见，它实际上应该在顶部栏中显示登录人员的姓名。但是，然而，它完全是空的。我在这里做错了什么？

Answer 1

您永远不会从查询中获取结果，您需要从查询中请求正确的列名:

if (mysql_num_rows($query)==true) {
    $name = mysql_fetch_assoc($names)
    echo $name['contactFirstName']; // change the column name here
} else {...

You need to prevent SQL Injection否则有人会让您的所有数据消失。

拜托，stop using mysql_* functions .它们不再维护并且是 officially deprecated .了解 prepared statements相反，并使用 PDO .