首頁猿問 PHP |...

PHP | SQL-mysqli_stmt_prepare失敗并連接到數(shù)據(jù)庫

PHP

慕田峪9158850 2021-04-29 13:14:40

我正在嘗試執(zhí)行參數(shù)化查詢以更新數(shù)據(jù)庫中的某些內(nèi)容。問題是它mysqli_stmt_prepare失敗。require用于連接數(shù)據(jù)庫。require 'includes/dbInclude.php';if ($codeQuery > 0){ $confirmationUsername = $_GET['confirmationUsername']; $active = "active"; $noCode = ""; $insertSql = "UPDATE users SET accountStatus = ? WHERE username = $confirmationUsername"; $insertSql2 = "UPDATE users SET confirmationCode = ? WHERE username = $confirmationUsername"; $statement = mysqli_stmt_init($connection); $statement2 = mysqli_stmt_init($connection); if (!mysqli_stmt_prepare($statement, $insertSql)){ header("Location: registerComplete.php?error=sqlError1"); exit(); } elseif (!mysqli_stmt_prepare($statement2, $insertSql2)){ header("Location: registerComplete.php?error=sqlError2"); exit(); } else{ mysqli_stmt_bind_param($statement, "s", $active); mysqli_stmt_execute($statement); mysqli_stmt_bind_param($statement2, "s", $noCode); mysqli_stmt_execute($statement2); }}dbInclude.php包含：<?php//connection variables$serverName = "localhost";$dbUsername = "root";$dbPassword = "";$dbName = "ecglive";//connection$connection = mysqli_connect($serverName, $dbUsername, $dbPassword, $dbName);//connection errorif(!$connection){ die("There was an error connceting to the database: " . mysqli_connect_error());}在我使用它的地方。我也嘗試將代碼復(fù)制到此代碼中，以查看是否存在連接數(shù)據(jù)庫的任何問題。不是。如果它在第一個(gè)錯(cuò)誤處顯示sqlError1，并且如果我刪除了它，則它總是在第一個(gè)錯(cuò)誤處發(fā)生，然后轉(zhuǎn)到sqlError2。我有沒有做錯(cuò)什么？

查看完整描述

2 回答

躍然一笑

TA貢獻(xiàn)1826條經(jīng)驗(yàn) 獲得超6個(gè)贊

username除了以外，您還需要綁定，accountstatus以幫助減輕SQL注入。

require 'includes/dbInclude.php';

if ($codeQuery > 0){

$confirmationUsername = $_GET['confirmationUsername'];

$active = "active";

$noCode = "";

$insertSql = "UPDATE users SET accountStatus = ? WHERE username = ?";

$insertSql2 = "UPDATE users SET confirmationCode = ? WHERE username = ?";

$statement = mysqli_stmt_init($connection);

$statement2 = mysqli_stmt_init($connection);

if (!mysqli_stmt_prepare($statement, $insertSql)){

exit(header("Location: registerComplete.php?error=sqlError1") );

} elseif (!mysqli_stmt_prepare($statement2, $insertSql2)){

exit(header("Location: registerComplete.php?error=sqlError2") );

} else{

mysqli_stmt_bind_param($statement, "ss", $active,$confirmationUsername);

mysqli_stmt_execute($statement);

mysqli_stmt_bind_param($statement2, "ss", $noCode,$confirmationUsername);

mysqli_stmt_execute($statement2);

}

反對(duì) 回復(fù) 2021-05-07

當(dāng)年話下

TA貢獻(xiàn)1890條經(jīng)驗(yàn) 獲得超9個(gè)贊

這段代碼使用了一種非常奇怪的樣式，它的冗長程度遠(yuǎn)遠(yuǎn)超過了必需的樣式。這是相同形式的更簡單形式：

require 'includes/dbInclude.php';

// Enable exception reporting

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

if ($codeQuery > 0) {

try {

// Prepare one query that sets both properties.

$stmt = $connection->prepare('UPDATE users SET accountStatus=?,confirmationCode=? WHERE username=?');

// Bind parameters directly form the source, no variables needed.

$stmt->bind_param('ss', 'active', '', $_GET['confirmationUsername']);

// Attempt to execute

$stmt->execute();

}

catch (Exception $e) {

// Error handling here...

header("Location: registerComplete.php?error=sqlError2");

exit();

}

您在這里實(shí)際上并沒有做很多事情，因此沒有理由使代碼如此冗長。

就是說，如果這是用于某種用戶訪問控制層的注冊(cè)系統(tǒng)，并且這不是一個(gè)學(xué)術(shù)項(xiàng)目，則應(yīng)在創(chuàng)建巨大混亂之前停止使用此代碼。編寫自己的訪問控制層并不容易，并且有很多機(jī)會(huì)可以使它嚴(yán)重錯(cuò)誤。

諸如Laravel這樣的任何現(xiàn)代開發(fā)框架都內(nèi)置了強(qiáng)大的身份驗(yàn)證系統(tǒng)。這是一個(gè)已解決的問題，您無需嘗試在這里重新發(fā)明輪子。

至少應(yīng)遵循建議的最佳安全最佳做法，并且永遠(yuǎn)不要將密碼存儲(chǔ)為純文本或弱哈希（如SHA1或MD5）。

反對(duì) 回復(fù) 2021-05-07