English 中文(简体)
我的SQLi编写带有爱护特征的声明
原标题:mySQLi Prepared Statement Select with Escape Characters

我正试图利用发言稿从我的SQL桌上挑选。 某些老板是用户形式的投入,因此,我对这个变量具有约束力,并使用准备的声明。 如下:

$sql_query = "SELECT first_name_id from first_names WHERE first_name = ?";
$stmt = $_SESSION[ mysqli ]->prepare($sql_query);

    $stmt->bind_param( s , $_SESSION[ first_name ]);
    $stmt->execute();
    $stmt->store_result();

    if ($stmt->num_rows ==  1 ) {
            $stmt->bind_result($_SESSION[ first_name_id ]);
            $stmt->fetch();
    } else {
            $stmt->close();
            $sql_query = "INSERT INTO first_names (first_name) VALUES (?)";
            $stmt = $_SESSION[ mysqli ]->prepare($sql_query);
            $stmt->bind_param( s , $_SESSION[ first_name ]);
            $stmt->execute();
            $_SESSION[ first_name_id ] = $_SESSION[ mysqli ]->insert_id;
    }
    $stmt->close();

显然,我的法典只是确定第一个名字在第一个名字表中是否已经存在。 如果是的话,它就归还相应的身份证(第一是姓名_id)。 否则,该法典将新名称列入第一个名称表格,并插入。

问题是,用户在进入名字时有越狱的性质(Henry s)。 不太可能有第一名字,当然还有雇主。 发生这种情况时,该法典没有执行(没有在记录档案中选择或插入活动)。 因此,像我的SQL一样,由于变数的越狱性质,似乎忽略了该守则。

我如何解决这一问题? 我的法典对于任务是否高于效率和正确?

问题2. 守则接着加上或更新如下文法所示:

if (empty($_SESSION[ personal_id ])) {
            $sql_query = "INSERT INTO personal_info (first_name_id, start_timestamp) VALUES (?, NOW())";
    } else {
            $sql_query = "UPDATE personal_info SET first_name_id = ? WHERE personal_info =  $_SESSION[personal_id] ";
    }

    $stmt = $_SESSION[ mysqli ]->prepare($sql_query);
    $stmt->bind_param( i , $_SESSION[ first_name_id ]);
    $stmt->execute();

    if (empty($_SESSION[ personal_id ])) {
            $_SESSION[ personal_id ] = $_SESSION[ mysqli ]->insert_id;
    }
    $stmt->close();

The issue with the code above is that I cannot get it to work at all. I am not sure if there is some conflict with the first part of the script, but I have tried everything to get it to work. There are no PHP errors and there are no inserts or updates showing in the mySQL log files from this code. It appears that the bind_param line in the code may be where the script is dying...

任何帮助都将受到高度赞赏。

最佳回答

您在将用户输入目录之前,应确认/替代用户的意见。

mysql-real-einski-string()

问题回答

暂无回答




相关问题
Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

please can anyone check this while loop and if condition

<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...

定值美元

如何确认来自正确来源的数字。

Generating a drop down list of timezones with PHP

Most sites need some way to show the dates on the site in the users preferred timezone. Below are two lists that I found and then one method using the built in PHP DateTime class in PHP 5. I need ...

Text as watermarking in PHP

I want to create text as a watermark for an image. the water mark should have the following properties front: Impact color: white opacity: 31% Font style: regular, bold Bevel and Emboss size: 30 ...

How does php cast boolean variables?

How does php cast boolean variables? I was trying to save a boolean value to an array: $result["Users"]["is_login"] = true; but when I use debug the is_login value is blank. and when I do ...

热门标签