为什么这段代码没有将任何东西写入数据库?

Why is this piece of code not writing anything into database?

提问人:Gregory Sky 提问时间:5/9/2020 最后编辑:Gregory Sky 更新时间:5/9/2020 访问量:66

问:

我需要第二双眼睛来查看我的代码并告诉我我缺少什么,因为我认为我已经确定了代码中不起作用的部分,我只是不知道为什么。

基本上,我正在尝试将用户注册到数据库,以阻止SQL注入的方式。然而,对于我的生活来说,这是行不通的。当我解构代码并降低其安全性时,它就可以工作了。无论如何,代码在这里:

//require_once 'sendEmails.php'; 
session_start();
$username = "";
$email = "";
$user_dob = "";
$user_fname = "";
$user_lname = "";
$user_telephone = "";
$errors = [];
$servername = '';
$login = '';
$password = '';
$DBname = '';
$rows = 0;
$query = "";


$conn = new mysqli($servername, $login, $password, $DBname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($conn) {
  echo "Connected successfully";
}

// SIGN UP USER
if (isset($_POST['signup-btn'])) {
    if (empty($_POST['username'])) {
        $errors['username'] = 'Username required';
    }
    if (empty($_POST['email'])) {
        $errors['email'] = 'Email required';
    }
    if (empty($_POST['password'])) {
        $errors['password'] = 'Password required';
    }
    if (isset($_POST['password']) && $_POST['password'] !== $_POST['passwordConf']) {
        $errors['passwordConf'] = 'The two passwords do not match';
    }
    if (empty($_POST['dob'])) {
        $errors['dob'] = 'Date of birth required';
    }
    if (empty($_POST['fname'])) {
        $errors['fname'] = 'First name required';
    }
    if (empty($_POST['lname'])) {
        $errors['lname'] = 'Last name required';
    }
    if (empty($_POST['telephone'])) {
        $errors['telephone'] = 'Telephone number required';
    } //--checks input in browser

    //I think it works untill this point...

    $token = bin2hex(random_bytes(50)); // generate unique token
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_BCRYPT); //encrypt password
    $user_dob = $_POST['dob'];
    $user_fname = $_POST['fname'];
    $user_lname = $_POST['lname'];
    $user_telephone = $_POST['telephone'];
    $email = $_POST['email'];

    //Above assigns inputted values into variables declared at the start

    //echo $token, $email; //-- this works
    //nl2br() ; // -- line break in php

    // Check if email already exists
    //$result = $mysqli->query("SELECT * FROM User_tbl WHERE email='$email' LIMIT 1");



    $sql = "SELECT * FROM User_tbl WHERE email='$email' LIMIT 1";
    $result = mysqli_query($conn, $sql);
    if (mysqli_num_rows($result) > $rows) {
              $errors[] = $email;
        echo "Email already exists";
    }

    $errorsInt = count($errors);
    echo mysqli_num_rows($result);
    echo count($errors);
    echo $errorsInt;

    if ($errorsInt === $rows) {
        $query = "INSERT INTO User_tbl SET token=?, username=?,  password=?, user_dob=?, user_fname=?, user_lname=?, user_telephone=?, email=?";
      // "INSERT INTO User_tbl VALUES (?, ?, ?, ?, ?, ?, ?, ?)"

        echo $query;
    //---------------------------------------------------------------------------

        $stmt = $conn->prepare($query); //first
        $stmt->bind_param('sssissis', $token, $username, $password, $user_dob, $user_fname, $user_lname, $user_telephone, $email);
        $result = $stmt->execute();

        echo $result;

            if ($result) {
                $user_id = $stmt->insert_id;
                $stmt->close();

                $_SESSION['id'] = $user_id;
                $_SESSION['username'] = $username;
                $_SESSION['email'] = $email;
                $_SESSION['verified'] = false;
                $_SESSION['message'] = 'You are logged in!';
                $_SESSION['type'] = 'alert-success';
                header('location: index.php');
            } else {
                $_SESSION['error_msg'] = "Database error: Could not register user";
            }
        }


}

我认为问题从这里开始:

$stmt = $conn->prepare($query); //first
        $stmt->bind_param('sssissis', $token, $username, $password, $user_dob, $user_fname, $user_lname, $user_telephone, $email);
        $result = $stmt->execute();
php 安全 mysqli sql 注入 注册

评论

0赞 Barmar 5/9/2020
尝试插入时是否遇到错误?
0赞 Barmar 5/9/2020
当插入失败时,您应该打印以查看原因。$stmt->error
3赞 Frank B 5/9/2020
或添加 mysqli_report(MYSQLI_REPORT_ERROR |MYSQLI_REPORT_STRICT);添加代码的开头,但最好使用 PDO
0赞 Jason Stephenson 5/9/2020
我和弗兰克在一起,使用 PDO。您还可以通过调用 mysqli_error() 来查看最后一个错误,因此将其放在代码的末尾,作为临时度量
0赞 jotaelesalinas 5/9/2020
您正在使用绑定值的类型。你确定里面有两个整数吗?日期应以字符串形式输入,例如 ,电话号码也应输入。检查表架构。'sssissis''2020-05-08'

答: 暂无答案