無法從數據庫中獲取數據

Question

在我的網站上，我想要轉到特定頁面（fe：challenge.php？challenge_id = 4）。 這個數字是從與該函數的DB來當我登錄我想去那個頁面：

header("Location: challenge.php?challenge_id=" . $current_cid . ""); 

但問題是，他不給的網址是多少？

$current_cid =我檢索這個數字與功能：getUserInfoByEmail1();

DB：

if(!empty($_POST["btnSignin"])) 
    { 
     try 
     { 

      $user = new User(); 
      $user->Email = $_POST["email"]; 
      $user->Password = $_POST["password"]; 
      $u_email = $user->getUserInfoByEmail1($user->Email); 
      $current_cid = $u_email['current_challenge_id']; 
      var_dump($current_cid); 
      $user->Login($current_cid); 

     } 
     catch(Exception $e) 
     { 
      $feedback = $e->getMessage(); 
     } 
    } 

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $_SESSION["email"] . "';"; 
    $result = $db->conn->query($select); 
    return $data=mysqli_fetch_assoc($result); 
} 

    public function Login($current_cid) 
    { 

     $salt = "ab4p73wo5n3ig247xb1w9r"; 
     $db = new Db(); 
     $select = "SELECT * FROM tblusers WHERE email = '" . $db->conn->real_escape_string($this->Email) . 
        "' AND password = '" . $db->conn->real_escape_string(md5($this->Password . $salt)) . "';"; 
     $result = $db->conn->query($select); 
     if($result->num_rows == 1) 
     { 
      // logged in, naam session ophalen en je schermt springt door naar challenge.php 
      session_start(); 
      $_SESSION["loggedin"] = true; 
      $_SESSION["name"] = $this->Name; 
      $_SESSION["surname"] = $this->Surname; 
      $_SESSION["email"] = $this->Email; 
      var_dump($current_cid);  
     header("Location: challenge.php?challenge_id=" . $current_cid . ""); 

     //header("Location: challenge.php?challenge_id=1"); 

     } 
     else 
     { 
      throw new Exception("Please enter correct username and password"); 
     } 
    } 

Answer 1

你應該改變功能：

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $_SESSION["email"] . "';"; 
    $result = $db->conn->query($select); 
    return $data=mysqli_fetch_assoc($result); 
} 

到：

public function getUserInfoByEmail1($email) 
{ 
    $db = new Db(); 
    $select = "SELECT * FROM tblusers WHERE email = '" . $email . "';"; 
    $result = $db->conn->query($select); 
    return mysqli_fetch_assoc($result); 
} 

而不是使用函數參數（$電子郵件）的

您使用$ _SESSION [「電子郵件」]

您還應該添加可能mysqli_real_escape_string防止SQL注入。你也應該考慮爲什麼你使用mysqli_fetch_assoc使用數據庫對象。你應該使用你的Db方法或mysqli函數，現在你將它們混合在一起什麼不是編寫你的應用程序的最佳方式