使用預處理語句檢查數據庫中是否已存在電子郵件

Question

我試圖將我的代碼更改爲msqli從mysql準備的語句。我不確定如何調整當前可用的代碼，以檢查數據庫中是否存在電子郵件。以下是我目前正在使用該作品的代碼。我如何將此變爲準備好的陳述並獲得相同的結果？

//if email is equal to an email already in the database, display an error message 

if(mysql_num_rows(mysql_query("SELECT * FROM users WHERE email = '".mysql_real_escape_string($_POST['email'])."'"))) 
{ 
    echo "<p class='red'>Email is already registered with us</p>"; 
} else { 
    // missing code? 
} 

Answer 1

應該是這樣的：

// create mysqli object 
$mysqli = new mysqli(/* fill in your connection info here */); 

$email = $_POST['email']; // might want to validate and sanitize this first before passing to database... 

// set query 
$query = "SELECT COUNT(*) FROM users WHERE email = ?" 

// prepare the query, bind the variable and execute 
$stmt = $mysqli->prepare($query); 
$stmt->bind_param($email); 
$stmt->execute() 

// grab the result 
$stmt->store_result(); 

// get the count 
$numRows = $stmt->num_rows(); 

if($numRows) 
{ 
    echo "<p class='red'>Email is already registered with us</p>"; 
} 
else 
{ 
    // .... 
} 

此鏈接可以幫助你，以及：

http://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php