編寫的語句導致錯誤

Question

我是PHP的新手，在嘗試將mysqli調用轉換爲PDO預準備語句時仍然遇到錯誤。數據庫連接已被設置爲PDO。它的字面大小在3-4左右，但我無法做到這一點。

PHP代碼：

//error_reporting(E_ALL); 
//ini_set('display_errors', TRUE); 

require 'vdb_includes/db.php'; 
require 'functions.php'; 

//Declaring variables as whitespace so nothing will be displayed below the form until submission. 
$fe_firstName = " "; 
$fe_lastName = " "; 
$fe_email = " "; 
$fe_emailconf = " "; 
$fe_username = " "; 
$fe_pw = " "; 
$fe_pwconf = " "; 
$fe_terms = " "; 
$fe_usernameInvalid = " "; 
$fe_emailInvalid = " "; 
//Declaring verification variables to ensure duplicate users aren't created. 
$verifyUsername = $_POST['username']; 
$verifyEmail = $_POST['email']; 

//Setting up array, if zero errors occur the array will stay empty. 
$errors = array(); 


//The URL of the signup page. 
//The full URL of the page the form was submitted from. 
$current = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; 
$referrer = $_SERVER['HTTP_REFERER']; 

//Ensure form comes from VAL website. 
if ($referrer == $current) { 

if($_SERVER['REQUEST_METHOD'] == 'POST'){ 
/** 
    * Validate forms 
    * Match regex 
    * Ensure pass & email confirmations match 
    */ 
    if(0 === preg_match("/^[a-z\-]{2,20}$/i", $_POST['firstName'])){ 
     $errors['e_firstName'] = "Your first name cannot be empty."; 
     $fe_firstName = "Your first name cannot be empty."; 
    } 
    if(0 === preg_match("/^[a-z\-]{2,20}$/i", $_POST['lastName'])){ 
     $errors['e_lastName'] = "Your last name cannot be empty."; 
     $fe_lastName = "Your last name cannot be empty."; 
    } 
    if(0 === preg_match("/^[a-zA-Z0-9]+[a-zA-Z0-9_.-]+[a-zA-Z0-9_-]+@[a-zA-Z0-9]+[a-zA-Z0-9.-]+[a-zA-Z0-9]+.[a-z]{2,4}$/", $_POST['email'])){ 
     $errors['e_email'] = "Please enter a valid E-Mail address."; 
     $fe_email = "Please enter a valid E-Mail address."; 
    } 
    if(0 !== strcmp($_POST['email'], $_POST['emailconf'])){ 
     $errors['e_emailconf'] = "Please ensure your E-Mail addresses match."; 
     $fe_emailconf = "Please ensure your E-Mail addresses match."; 
    } 
    if(0 === preg_match("/^[a-z\d_]{3,20}$/i", $_POST['username'])){ 
     $errors['e_username'] = "Please enter a valid username."; 
     $fe_username = "Please enter a valid username."; 
    } 
    if(0 === preg_match("/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d]{8,56}$/", $_POST['pw'])){ 
     $errors['e_pw'] = "Please follow the password instructions. You must have at least one number, one lower-case, and one upper-case letter."; 
     $fe_pw = "Please follow the password instructions. You must have at least one number, one lower-case, and one upper-case letter."; 
    } 
    if(0 !== strcmp($_POST['pw'], $_POST['pwconf'])){ 
     $errors['e_pwconf'] = "Please ensure your passwords match."; 
     $fe_pwconf = "Please ensure your passwords match."; 
    } 
    if(!isset($_POST['terms'])){ 
     $errors['e_terms'] = "You must accept the Terms and Conditions."; 
     $fe_terms = "You must accept the Terms and Conditions."; 
    } 
/** 
    * Check if username and email address already exist. 
    * If so, add error to validity array. 
    */ 
$usernameCheck = mysqli_query($con, "SELECT * FROM users WHERE username='".$verifyUsername."'"); 
if($usernameCheck->num_rows){ 
    $errors['e_usernameInvalid'] = "Username already exists."; 
    $fe_usernameInvalid = "Username already exists."; 
} 
$emailCheck = mysqli_query($con, "SELECT * FROM users WHERE email='".$verifyEmail."'"); 
if($emailCheck->num_rows){ 
    $errors['e_emailInvalid'] = "Email already exists."; 
    $fe_emailInvalid = "Email already exists."; 
} 

    //If no validation errors 
    if(0 === count($errors)){ 
     //HASH & ready password 
     // 
     // Instantiate new instance of class 
     $hash_password = new Hash_Password(); 
     // Hash the password 
     $hash = $hash_password->hash($password); 
     $send_pw = $hash; 
     //Autoset non-user-input values to 0 
    $send_wins = 0; 
    $send_losses = 0; 
    $send_played = 0; 
    $send_earnings = 0; 
     //Obtain time of form submission = Time registered. 
     $datum = new DateTime(); 
     $send_regDate = $datum->format('Y-m-d H:i:s'); 
     $send_lastLogin = $send_regDate; 
     $send_rolePermissions = 0; 

     //Insert query time. 
    $sql = " 
    INSERT INTO users (first_name, last_name, username, password, email, last_login, date_joined, wins, losses, played, earnings, permissions) VALUES 
    (:firstName,:lastName,:username,:pw,:email,'{$send_lastLogin}','{$send_regDate}','{$send_wins}','{$send_losses}','{$send_played}','{$send_earnings}','{$send_rolePermissions}') 
    "; 
     $stmt = $con->prepare($sql); 
    /*** 
     * Sanitize code 
     * Clean dangerous chars for DB 
     */ 
     $stmt->bindParam(':firstName, $_POST[firstName]'); 
     $stmt->bindParam(':lastName, $_POST[lastName]'); 
     $stmt->bindParam(':email, $_POST[email]'); 
     $stmt->bindParam(':username, $_POST[username]'); 
     $stmt->bindParam(':pw, $send_pw'); 

     //Redirecting based on the connection result. 
    if(!$stmt->execute()){ 
      if (!headers_sent()) { 
       exit(header("Location: registration_fail.php")); 
      } else{ 
       ?> 
      <script> location.replace("registration_fail.php"); </script> 
       <?php 
      } 
    } else{ 
      if (!headers_sent()) { 
       exit(header("Location: registration_success.php")); 
      } else{ 
       ?> 
      <script> location.replace("registration_success.php"); </script> 
       <?php 
      } 
      mysqli_close($con); 
    } 

    } 

} 
} 

DP連接：

try{ 
    $con = new PDO("mysql:host=$server;dbname=$database;", $db_username, $db_password); 
} catch(PDOException $e){ 
    die("Connection failed: " . $e->getMessage()); 
} 

我充分意識到，在確認底部的用戶名和電子郵件檢查也需要轉換，但是曾經與這些刪除代碼，發生同樣的錯誤。

錯誤與語句的執行有關。它重定向到失敗頁面，但我不確定導致執行失敗的原因是什麼？

Answer 1

我寧願使用的mysqli做準備的語句： 所以代碼應該是以下幾點：

$link=//the statement you want prepared 
$host=//whatever host; 
$user=//user; 
$pass=//pass; 
$db=//your db; 
$connect = new mysqli($host, $user, $pass, $db); 
$prepared=$connect->prepare("SELECT column_name FROM table_name WHERE column_name=?"); 
$prepared->bind_param("s", $link); // "s" is for string 
$prepared->execute(); 
$prepared->bind_result($result); // get results 
$prepared->fetch(); // fetch them 
$prepared->close(); 
$connect->close(); //close connection;