由於「$ mysqli-> prepare」，我的預防SQL注入代碼不起作用，任何人都可以幫助我嗎？

Question

我的預防SQL注入代碼不起作用。誰能幫我？用C的mysqli：

我收到這樣的警告：

注意：未定義的變量\ XAMPP \ htdocs中\ teknohuk \ fetch_pages.php上線18

致命錯誤：未捕獲的錯誤：呼叫添加到C：\ xampp \ htdocs \ teknohuk \ fetch_pages.php中的null成員函數prepare（）中：18堆棧跟蹤：＃0 {main}引發第18行C：\ xampp \ htdocs \ teknohuk \ fetch_pages.php

謝謝。

<?php 
 
include("connection.php"); //include config file 
 
//sanitize post value 
 

 
$item_per_page = 1; 
 
//throw HTTP error if page number is not valid 
 

 
$page_number = filter_var($_POST["page"], FILTER_SANITIZE_NUMBER_INT, FILTER_FLAG_STRIP_HIGH); 
 

 
if(!is_numeric($page_number)){ 
 
\t header('HTTP/1.1 500 Invalid page number!'); 
 
\t exit(); 
 
} 
 

 
//get current starting point of records 
 
$position = (($page_number-1) * $item_per_page); 
 

 
//line 17 
 
$results = $mysqli->prepare("SELECT id, haberAd, haberOzet, haberTarih, haberFotoURL FROM haber ORDER BY id DESC LIMIT ?, ?");//line 18 
 
//line19 
 
$results->bind_param("issss", $position, $item_per_page); 
 
$results->execute(); //Execute prepared Query 
 
$results->bind_result($id, $haberAd, $haberOzet, $haberTarih, $haberFotoURL); //bind variables to prepared statement 
 

 
//output results from database 
 

 
while($results->fetch()){ //fetch values 
 
\t echo "<div class='haber'> \t 
 
\t \t \t \t <div class='haberResim'><img src='img/haberler/" . $haberFotoURL . ".jpg'></div> 
 
\t \t \t \t <div class='haberYazi'><div class='haberBaslik'>" . $haberAd . "</div>" . $haberOzet . "</div>" . 
 
\t \t \t \t "<div class='haberAciklama'><div class='row'><div class='block'></div></div> 
 
     <div class='haberTarih'>" . $haberTarih . "</div></div></div>"; 
 
} 
 
?>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
 
<?php 
 
//Connection.php 
 

 
    $vt_sunucu   = 'localhost'; 
 
    $vt_kullanici_adi = 'root'; 
 
    $vt_kullanici_sifre = ''; 
 
    $vt_adi    = 'gadmin'; 
 

 
$mysqli = mysqli_connect($vt_sunucu, $vt_kullanici_adi, $vt_kullanici_sifre, $vt_adi); 
 
$mysqli->query("SET NAMES utf8"); 
 

 
if (!$mysqli) { 
 
    die("Connection failed: " . mysqli_connect_error()); 
 
} 
 
?>

Answer 1

這是無法識別變量$mysqli。

該變量未在此頁面定義connection.php或文件未正確包含。

試試這個：

require_once ("connection.php"); // will throw Fatal error if path is incorrect 

var_dump($mysqli); // Check the value.