從mysql_轉換到PDO php錯誤

Question

剛剛從mysql_轉換到PDO。當然會得到一些錯誤。

<?php 
ob_start(); 
session_start(); 
include("php/connect.php"); 

if ($_POST['submit']){ 

    $username = $db -> prepare($_POST['username']); 
    $password = $db -> prepare($_POST['password']); 

    if($username){ 

     if($password){ 

      $password = md5(md5("KmsdufIFNKSnefndbdo19228330293".$password."JSDSHBFJS8S8ds8sd8s8d")); 
      $query = $db -> query("SELECT * FROM user WHERE username='$username'");    
      $num_rows = $db -> rowCount($query); 

      if ($num_rows == 1){ 

       $row = $query -> fetch(PDO::FETCH_ASSOC); 
       $db_username = $row['username']; 
       $db_password = $row['password']; 

       if ($password == $db_password){ 

        $_SESSION['username'] = $username; 

       }else 
        $div = "<div id='error'>Passwordi eshte gabim</div>"; 

      }else 
       $div = "<div id='error'>Emri nuk u gjend</div>"; 

     }else 
      $div = "<div id='error'>Futeni Passwordin</div>"; 

    }else 
     $div= "<div id='error'>Futeni emrin e llogarise</div>"; 
} 
?> 

Answer 1

pdo::prepare不是mysql_real_escape_string的替代品。它分析一個sql語句（或讓底層數據庫系統執行該操作，請參閱PDO::ATTR_EMULATE_PREPARES），查找執行語句時由實際參數替換的佔位符。

$stmt = $db->prepare('SELECT * FROM user WHERE username=?'); 
// $stmt now "is" the identifier for the previously prepared statement 
// it can be executed but needs one parameter to fill out the placeholder 
$stmt->execute(array($_POST['username'])); 
// it could be executed again with another parameter 
// $stmt->execute(array('Foo')); 
$row = $stmt->fetch(PDO::FETCH_ASSOC); 
if (!$row) { 
    // no such user 
} 
else { 
    .... 

還看到：

• http://docs.php.net/pdo.prepared-statements
• http://wezfurlong.org/images/PDO.pdf

Answer 2

看一看的prepare方法（http://de3.php.net/manual/en/pdo.prepare.php）。你錯了。你必須在那裏插入你的陳述。 並且：請使用預準備語句，而不是直接（unsanitized）變量輸入。

我認爲，PHP手冊是一個很好的起點。

Answer 3

你需要使用的PDO的格式（基於你正在嘗試做的）是：

$sql = 'SELECT query here .......'; 
$stmt = $db->prepare($sql); 
$stmt->execute(); 
$result = $stmt->fetch(PDO::FETCH_ASSOC); 

if ($result) { 
. 
. 
. 
}