PHP的mysqli不準備準備發言

Question

，所以我有一個登錄頁面，它工作得非常好使用PHP mysqli的，但它是不可做準備，所以我通常用mysqli_real_escape保護數據。

但我現在遷移到使用事先準備好的聲明，有管理這與我的註冊頁面，並以此作爲很好地工作。

這裏是我不準備登錄代碼：

 $loginQuery = "select * from user where user_name = '$user_name' AND password = '$password'"; 
     $result = mysqli_query($con,$loginQuery); 
     if(mysqli_num_rows($result)){ 

       $row = mysqli_fetch_array($result); 

    // password verify 
if (password_verify($password, $row['password'])) { 

       $_SESSION['user_id'] = $row['id']; 
       $_SESSION['user_name'] = strtoupper($row['user_name']); 
       $user_type = strtolower($row['user_type']); 
       if(strtolower($user_type) == 'member'){ 

        $_SESSION['user_type'] = 'member'; 
        //header('Location: member-dashboard-home.php'); 
        header('Location: profile.php'); 

       }elseif(strtolower($user_type) == 'admin' || strtolower($user_type) == 'leader'){ 

        $_SESSION['user_type'] = strtolower($user_type);           
        //header('Location: admin-dashboard-home.php'); 
        header('Location: profile.php'); 
       } 


     }else{ 
       $_SESSION['main_notice'] = "Invalid login details!"; 
       header('Location: '.$_SERVER['PHP_SELF']);exit(); 
     } 

及以下是我在使用事先準備好的聲明的努力。

 $stmt = $mysqli->prepare("SELECT user_name FROM user WHERE user_name = ? "); 
    $stmt->bind_param('s', $user_name); 
    $stmt->execute(); 
    $stmt->bind_result($user_name); 
     if($res = $stmt->num_rows()){ 

     $row = $stmt->fetch_array($res); 

    // password verify 
    if (password_verify($password, $row['password'])) { 

       $_SESSION['user_id'] = $row['id']; 
       $_SESSION['user_name'] = strtoupper($row['user_name']); 
       $user_type = strtolower($row['user_type']); 
       if(strtolower($user_type) == 'member'){ 

        $_SESSION['user_type'] = 'member'; 
        //header('Location: member-dashboard-home.php'); 
        header('Location: profile.php'); 
     // exit; 

       }elseif(strtolower($user_type) == 'admin' || strtolower($user_type) == 'leader'){ 

        $_SESSION['user_type'] = strtolower($user_type);           
        //header('Location: admin-dashboard-home.php'); 
        header('Location: profile.php'); 
     //exit; 
       } 

    }else{ 
       $_SESSION['main_notice'] = "Invalid username OR password details, please try again!"; 
       header('Location: '.$_SERVER['PHP_SELF']);exit(); 
      }  
} 

我沒有得到任何錯誤代碼，當我試圖登錄，但形式只是返回的空白，並沒有重定向到用戶配置文件。

我不認爲這是重定向問題還是它呢？

我不我安排$stmt正確，希望你的人看看我能不能。

在此先感謝

Answer 1

從您的評論，

i did include at the top and i receive this error Notice: Undefined variable: mysqli in /home/connection.php... ...

看看你的代碼在這裏，

$con = new mysqli("localhost", "***", "***", "***"); 
if ($mysqli->connect_errno) { 
    ^^^^^^^^^^^^^^^^^^^^^^ 
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error; 
              ^^^^^^^^^^^^^^^^^^^^^^   ^^^^^^^^^^^^^^^^^^^^^^ 
} 

你連接處理器$con，不$mysqli，它應該是這樣的：

$con = new mysqli("localhost", "***", "***", "***"); 
if ($con->connect_errno) { 
    echo "Failed to connect to MySQL: (" . $con->connect_errno . ") " . $con->connect_error; 
} 

更新（1）：更改代碼以下列方式，

$stmt = $con->prepare("SELECT * FROM user WHERE user_name = ? "); 
$stmt->bind_param('s', $user_name); 
$stmt->execute(); 
$result = $stmt->get_result(); 
if($result->num_rows){ 
    // username exists 
    $row = $result->fetch_array(); 

    // your code 

}else{ 
    // username doesn't exist 

    // your code 

}