我的SQL数据行返回0

我检查了所有的变量。他们都包含正确的数据。但是，当我调用mysql_num_rows（）时，它将返回NULL，而不是1.所以，当我们的登录脚本实际上是正确的时，它会输入错误的用户名和密码。我的SQL数据行返回0

<?php 
ini_set('display_errors', 'On'); 
error_reporting(E_ALL | E_STRICT); 

ob_start(); 
$host="mywebsite.it"; // Host name 
$username="whateveruser"; // Mysql username 
$password="whateverpassword"; // Mysql password 
$db_name="whateverdb"; // Database name 
$tbl_name="whatevertable"; // Table name 

// Connect to server and select databse. 
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB"); 
print "$db_name\n";/*These is correct*/ 
print "$tbl_name\n";/*These is correct*/ 
// Define $myusername and $mypassword 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 


/*To protect MySQL injection*/ 
$myusername = stripslashes($myusername); 
$mypassword = stripslashes($mypassword); 
$myusername = mysql_real_escape_string($myusername); 
$mypassword = mysql_real_escape_string($mypassword); 

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'"; 
$result=mysql_query($sql); 
print "\n$result"; /*These is correct*/ 
// Mysql_num_row is counting table row 
$count = mysql_num_rows($result); /*This isn't actually returning 1*/ 
echo '<pre>'; var_dump($count); echo '</pre>'; 


// If result matched $myusername and $mypassword, table row must be 1 row 

if($count==1){ 

// Register $myusername, $mypassword and redirect to file "login_success.php" 
session_register("myusername"); 
session_register("mypassword"); 
header("Location:Target.php"); 
} 
else { 

echo "Wrong Username or Password"; /*my script always goes here*/ 
} 

ob_end_flush(); 
?>

来源

2013-12-09 Giuseppe Tonello

你确定你的查询返回任何行？你是否从命令行运行它来验证它呢？ –

这似乎没关系。回应你的查询并直接在你的mysql环境中运行它。 –

或者在phpMyAdmin中，例如，如果您无权访问命令行。 –

这看起来应该可以工作。但是，请停止使用mysql_ *函数。它们已被弃用，并且存在许多安全问题。

相反，我强烈建议您使用支持PDO等本机编码的库。（http://www.php.net/manual/en/class.pdo.php）具体来说，我建议你使用准备好的语句。（http://www.php.net/manual/en/pdo.prepare.php）

我在下面提供了一个快速示例。

这里是一个快速连接功能：

<?php 

function connectToDb($dbms, $host, $port, $username, $password) { 
    $dsn = sprintf('%s:host=%s;port=%d', $dbms, $host, $port); 

    $attributes = array(
     PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION 
    ); 

    // Wrap PDO instantiation in a try->catch so credentials don't end up in 
    // stack traces 

    try { 
     $connection = new PDO(
      $dsn, $username, $password, $attributes 
     ); 
    } catch (Exception $exception) { 
     throw new Exception($exception->getMessage()); 
    } 

    return $connection; 
}

这里是如何使用它的一个简单的例子：

// Connect to the database 

$connection = connectToDb(
    'mysql', 'localhost', '3306', 'bryan', '' 
); 

// Prepare the statement with parameters we can bind user input to 
// These parameters will be properyly encoded to prevent SQL injection 

$statement = $connection->prepare(
    'SELECT user,password FROM mysql.user WHERE user = :username' 
); 

// Perform the search with the user-supplied data 
// We'll pretend here with $usernameSearch 

$usernameSearch = 'bryan'; 

$statement->execute(
    array(':username' => $usernameSearch) 
); 

// Get the result set row count 

$rowCount = $statement->rowCount(); 

// Do What you need to do 

if ($rowCount > 0) { 
    // Fetch a row 
    $result = $statement->fetch(PDO::FETCH_ASSOC); 
    printf("Found a record for %s!\n", $result['user']); 
} else { 
    echo "No record found!\n"; 
}

来源

2013-12-09 15:50:15

我的SQL数据行返回0

回答

相关问题