試圖檢查它的用戶名和電子郵件已存在

Question

我想弄清楚爲什麼我的代碼不工作。我得到「調用成員函數execute（）在布爾」這應該表明我犯了一個SQL錯誤的錯誤。雖然我不確定它是什麼。我一直在看其他帖子，但他們對我來說並不是很有用。對不起，如果它是重複的。

if(isset($_POST["signup"])) { 
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING) 
     or die('Error: missing username'); 
$email = filter_input(INPUT_POST, 'email') 
    or die('Error: missing email'); 
$password = filter_input(INPUT_POST, 'password') 
    or die('Error: missing password'); 

$sql = $db->prepare('SELECT username, email FROM wyvern_user WHERE 
username=?, email=?'); 
$sql->execute(); 
$sql->bind_result($username, $email); 
while($stmt->fetch()) { 
if($username && $email > 1) { 
echo "User Already in Exists<br/>"; 
} else { 
$query = $db->prepare("INSERT INTO wyvern_user (username, email, password) 
VALUES(?, ?, ?)"); 
$query->bind_param('sss', $username, $email, $password); 
$query->execute(); 
echo "Account created";} 
} 
} 

這是我的形式，如果它有所作爲。

<form class="theform" action="signup.php" method="post"> 
    <p>Register as user:</p><br> 
    Username<span>*</span><input type="text" name="username" value="" 
    placeholder="username"><br><br> 
    Email<span>*</span> <input type="email" name="email" value="" 
    placeholder="email"><br><br> 
    Password<span>*</span><input type="password" name="password" 
    value="" placeholder="password"><br><br> 
    <input type="submit" name="signup" value="signup"><br><br> 
    </form> 

Answer 1

您的SQL語法不正確。在執行它之前，您需要執行bind parameters to your statement，如果不使用它們，則不需要獲取查詢結果。也許這將工作：

<?php 
if(isset($_POST["signup"])) { 
    $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING) 
     or die('Error: missing username'); 
    $email = filter_input(INPUT_POST, 'email') 
     or die('Error: missing email'); 
    $password = filter_input(INPUT_POST, 'password') 
     or die('Error: missing password'); 

    $sql = $db->prepare('SELECT username, email FROM wyvern_user WHERE username=? AND email=?'); 
    if (!$sql) { 
     die("Database error: $db->error"); 
    } 
    $sql->bind_param("ss", $username, $email); 
    $sql->execute(); 
    if ($sql->num_rows) { 
     echo "User already exists<br/>"; 
    } else { 
     $query = $db->prepare("INSERT INTO wyvern_user (username, email, password) VALUES(?, ?, ?)"); 
     $query->bind_param('sss', $username, $email, $password); 
     $query->execute(); 
     echo "Account created"; 
    } 
} 

不知道你的filter_input()功能是幹什麼的，但你並不需要使用預處理語句時，做任何消毒。您可以使用filter_var()和FILTER_VALIDATE_EMAIL來檢查電子郵件地址。