无法从数据库中获取数据

Question

在我的网站上，我想要转到特定页面（fe：challenge.php？challenge_id = 4）。 这个数字是从与该函数的DB来当我登录我想去那个页面：

header("Location: challenge.php?challenge_id=" . $current_cid . ""); 

但问题是，他不给的网址是多少？

$current_cid =我检索这个数字与功能：getUserInfoByEmail1();

DB：

if(!empty($_POST["btnSignin"])) 
    { 
     try 
     { 

      $user = new User(); 
      $user->Email = $_POST["email"]; 
      $user->Password = $_POST["password"]; 
      $u_email = $user->getUserInfoByEmail1($user->Email); 
      $current_cid = $u_email['current_challenge_id']; 
      var_dump($current_cid); 
      $user->Login($current_cid); 

     } 
     catch(Exception $e) 
     { 
      $feedback = $e->getMessage(); 
     } 
    } 

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $_SESSION["email"] . "';"; 
    $result = $db->conn->query($select); 
    return $data=mysqli_fetch_assoc($result); 
} 

    public function Login($current_cid) 
    { 

     $salt = "ab4p73wo5n3ig247xb1w9r"; 
     $db = new Db(); 
     $select = "SELECT * FROM tblusers WHERE email = '" . $db->conn->real_escape_string($this->Email) . 
        "' AND password = '" . $db->conn->real_escape_string(md5($this->Password . $salt)) . "';"; 
     $result = $db->conn->query($select); 
     if($result->num_rows == 1) 
     { 
      // logged in, naam session ophalen en je schermt springt door naar challenge.php 
      session_start(); 
      $_SESSION["loggedin"] = true; 
      $_SESSION["name"] = $this->Name; 
      $_SESSION["surname"] = $this->Surname; 
      $_SESSION["email"] = $this->Email; 
      var_dump($current_cid);  
     header("Location: challenge.php?challenge_id=" . $current_cid . ""); 

     //header("Location: challenge.php?challenge_id=1"); 

     } 
     else 
     { 
      throw new Exception("Please enter correct username and password"); 
     } 
    } 

Answer 1

你应该改变功能：

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $_SESSION["email"] . "';"; 
    $result = $db->conn->query($select); 
    return $data=mysqli_fetch_assoc($result); 
} 

到：

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $email . "';"; 
    $result = $db->conn->query($select); 
    return mysqli_fetch_assoc($result); 
} 

而不是使用函数参数（$电子邮件）的

您使用$ _SESSION [“电子邮件”]

您还应该添加可能mysqli_real_escape_string防止SQL注入。你也应该考虑为什么你使用mysqli_fetch_assoc使用数据库对象。你应该使用你的Db方法或mysqli函数，现在你将它们混合在一起什么不是编写你的应用程序的最佳方式