获取只有一个字段在PHP和mysqli的

Question

我有以下代码

if (isset($_POST['change'])) { 
    $current = mysqli_real_escape_string($con, $_POST['current']); 
    $password = mysqli_real_escape_string($con, $_POST['password']); 
    $cpassword = mysqli_real_escape_string($con, $_POST['cpassword']); 

    if(strlen($password) < 6) { 
     $error = true; 
     $password_error = "Password must be minimum of 6 characters"; 
    } 
    if($password != $cpassword) { 
     $error = true; 
     $cpassword_error = "Password and Confirm Password doesn't match"; 
    } 

    if(mysqli_fetch_field(mysqli_query($con, "SELECT password FROM users WHERE id = '" . $_SESSION['usr_id'] . "' LIMIT 1")) != md5($current)) { 
     $error = true; 
     $confirm_error = "Your actual password is not correct"; 
    } 
} 

的问题是在这里：

mysqli_fetch_field(mysqli_query($con, "SELECT password FROM users WHERE id = '" . $_SESSION['usr_id'] . "' LIMIT 1")) 

它给我的错误

PHP Catchable fatal error: Object of class stdClass could not be converted to string in /.../password.php on line 27

我曾尝试与

mysql_result(mysqli_query($con, "SELECT password FROM users WHERE id = '" . $_SESSION['usr_id'] . "' LIMIT 1"), 0)

，但它不工作，它给了我

PHP Fatal error: Uncaught Error: Call to undefined function mysql_result() in /.../password.php:27

我不想使用mysqli_fetch_array()和while循环。我搜索了一个功能或类似的东西，我发现了一些东西，但没有为我工作。

Answer 1

我不认为这是你最好的解决方案，但基于你问你可能想要使用mysqli_fetch_assoc。

$result = mysqli_query($con, "SELECT password FROM users WHERE id = '" . $_SESSION['usr_id'] . "' LIMIT 1"); 
$row = mysqli_fetch_assoc($result); 

if($row['password']!= md5($current)) { 
     $error = true; 
     $confirm_error = "Your actual password is not correct"; 
} 

在下面的注释中提到您应该使用参数化查询。对于用户密码使用密码哈希库像http://www.openwall.com/phpass/或内置password_hash功能在PHP 5> = 5.5.0，PHP 7

要参数当前的查询，并避免可能出现的SQL注入攻击尝试下面的代码。

$mysqliConnection = new mysqli("localhost", "my_user", "my_password", "my_dbname"); 

/* check connection */ 
if ($mysqliConnection->connect_errno) { 
    echo "Failed to connect to MySQL: (" . $mysqliConnection->connect_errno . ") " . $mysqliConnection->connect_error; 
} 

$sql = "SELECT password FROM users WHERE id = ? LIMIT 1"; 
$stmt = $mysqliConnection->prepare($sql); 
$stmt->bind_param("i", $_SESSION['usr_id']); 
$stmt->execute(); 
$stmt->bind_result($password); 
$stmt->store_result(); 
$row = $stmt->fetch() 

现在您可以使用$ password变量来检查您使用的密码散列。我希望这有帮助。

Answer 2

你需要阅读的文档mysqli_fetch_field()：

Returns the definition of one column of a result set as an object. Call this function repeatedly to retrieve information about all columns in the result set.

此功能不会在结果集中的一列返回值，它返回有关列元数据。像列名，表名，数据类型，最大长度等

如果您捕捉领域和转储吧，你看：

$passhash = mysqli_fetch_field(mysqli_query($con, "SELECT password FROM users WHERE id = '" . $usr_id . "' LIMIT 1")); 
print_r($passhash); 

输出：

stdClass Object 
(
    [name] => password 
    [orgname] => password 
    [table] => users 
    [orgtable] => users 
    [def] => 
    [db] => test 
    [catalog] => def 
    [max_length] => 32 
    [length] => 65535 <-- I used TEXT for the password column 
    [charsetnr] => 8 
    [flags] => 16 
    [type] => 252 
    [decimals] => 0 
) 

请注意，它作为对象返回，而不是标量值。所以你不能直接比较你的md5($current)。它甚至没有你正在寻找的价值。

这是我会怎么写你正在试图做的代码：

$sql = "SELECT password FROM users WHERE id = ? LIMIT 1"; 
$stmt = mysqli_prepare($con, $sql); 
$stmt->bind_param($stmt, "i", $_SESSION['usr_id']); 
$stmt->execute(); 
$result = $stmt->get_result(); 
$match = false; 
while ($row = $result->fetch_assoc()) { 
    if ($row['password'] == md5($current) { 
     $match = true; 
    } 
} 
if (!$match) { 
    $error = true; 
    $confirm_error = "Your actual password is not correct"; 
} 

你其他错误：

Call to undefined function mysql_result()

的mysql_result()功能已被弃用，它已经在PHP 7被删除。它不会与mysqli_query（）一起工作，因为它是不同API的一部分，并且这两个API不会混合使用。

mysqli_result（注意mysqli，而不是mysql）是资源类的名称，而不是函数。