無法從MySQL表中檢索數據

Question

首先，我是php的新手。我也是MySQL的新手，所以請對我溫和。其次，我知道mysql_ *被貶值，並且一旦我瞭解了更多信息，這個問題就會在稍後被修復。

所以我有以下代碼：

 if(isset($_POST['email']) && !empty($_POST['email']) AND isset($_POST['password']) && !empty($_POST['password'])){ 
      $email = mysql_escape_string($_POST['email']); 
      $password = mysql_escape_string($_POST['password']); 

      $search = mysql_query("SELECT * FROM users WHERE email='".$email."' AND password='".$password."' AND active='1'") or die(mysql_error()); 
      $match = mysql_num_rows($search); 

      if($match > 0){ 
       $user=$search['forename'] .' '.$search['surname']; 
       $_SESSION['username']=$user; 
       $msg = 'Login Complete! Thanks, '.$user.'!'; 
      }else{ 
       $msg = 'Login Failed!<br /> Please make sure that you enter the correct details and that you have activated your account.'; 
      } 
     } 

很簡單，我檢查了電子郵件地址和密碼匹配（我知道這是不是一個哈希密碼......再次，不是一個問題，因爲它是一個測試）。如果他們這樣做，並且帳戶已被激活，那麼我想要返回用戶名和姓（用戶表中的forename/surname）並將它們存儲在會話變量中。如果該變量已設置，我想使用此信息來確認用戶已登錄（並因此可以訪問某些頁面）。但是，此測試不返回用戶名，而是輸出：

登錄完成！謝謝， ！

任何幫助，將不勝感激。

Answer 1

記住由mysql_query的價值迴歸是資源，所以你需要將結果行獲取作爲關聯數組。

while ($row = mysql_fetch_assoc($search)) 
{ 
    $user=$row['forename'] .' '.$row['surname']; 
    $_SESSION['username']=$user; 
} 

作爲旁註，查詢是用SQL Injection脆弱，如果變量的值（小號）從外部來了。請看下面的文章，瞭解如何防止它。通過使用PreparedStatements你可以擺脫使用單引號圍繞值。

• How to prevent SQL injection in PHP?

Answer 2

你需要做的$row = mysql_fetch_array($search);

然後

$user=$row['forename'] .' '.$row['surname']; 

Answer 3

您更換代碼 /* ** * ** * ** * ***代碼* ***/ if（isset（$ _P （$ _ POST ['email']）AND isset（$ _ POST ['password']）& &！空（$ _ POST ['password']））{$ email = mysql_escape_string（$ _ POST ['email']）; $ password = mysql_escape_string（$ _ POST ['password']）;

 $search = mysql_query("SELECT * FROM users WHERE email='".$email."' AND password='".$password."' AND active='1'") or die(mysql_error()); 
     $match = mysql_num_rows($search); 

     if($match > 0){ 
      $user=$search['forename'] .' '.$search['surname']; 
      $_SESSION['username']=$user; 
      $msg = 'Login Complete! Thanks, '.$user.'!'; 
     }else{ 
      $msg = 'Login Failed!<br /> Please make sure that you enter the correct details and that you have activated your account.'; 
     } 
    } 

要

/* ** * ** * ** * ***我的代碼* ***/

if(isset($_POST['email']) && !empty($_POST['email']) AND isset($_POST['password']) && !empty($_POST['password'])){ 
     $email = mysql_escape_string($_POST['email']); 
     $password = mysql_escape_string($_POST['password']); 

     $search = mysql_query("SELECT * FROM users WHERE email='".$email."' AND password='".$password."' AND active='1'") or die(mysql_error()); 
     $match = mysql_num_rows($search); 

     if($match > 0){ 
      $search = mysql_fetch_array($search); 
      $user=$search['forename'] .' '.$search['surname']; 
      $_SESSION['username']=$user; 
      $msg = 'Login Complete! Thanks, '.$user.'!'; 
     }else{ 
      $msg = 'Login Failed!<br /> Please make sure that you enter the correct details and that you have activated your account.'; 
     } 
    }