從$ _SESSION的多個表中獲取數據PHP

Question

當前我想在用戶登錄到系統時從兩個表中獲取兩個不同的數據。權限表是「用戶」，「user_staff」和「user_group」。但是，當用戶輸入其用戶名和密碼，並提交提示「致命錯誤：調用第26行的C：\ xampp \ htdocs \ auditsystem \ index.php中的非對象上的成員函數fetch_array（）」

下面是代碼：

if($username!= "" && $password != "") 
{ 
//INNER JOIN user_group_module_role ON user.user_group_module_role_id = user_group_module_role.id 
    $result = $db->query("SELECT * FROM user 
          INNER JOIN user_staff ON user.user_staff_id = user_staff.id 
          WHERE username = '$username' AND password = '$password'"); 



    if($result->num_rows == 1) 
    { 
     $validate = $result->fetch_assoc(); 

     $query1 = "SELECT * FROM usergroup WHERE id = $validate[user_group_id]"; 
     $result1 = $db->query($query1); 
     $row1 = $result1->fetch_array(); 
     //change here for the authority 
     $_SESSION['user_staff'] = $validate['displayname']; 
     $_SESSION['usergroup'] = $row1['user_group_type']; 
     echo "<script language='javascript'>window.location='panel.php'</script>"; 
    } 
    else 
    { 
     echo "<script>alert('Sorry, wrong username and password please check.')</script>"; 
    } 
} 

Answer 1

您所查詢的格式不正確和失敗。這使得$ result1 null/false。您的查詢也容易受到SQL注入的攻擊！

if($username!= "" && $password != ""){ 
//INNER JOIN user_group_module_role ON user.user_group_module_role_id = user_group_module_role.id 
    $result = $db->query("SELECT * FROM user INNER JOIN user_staff ON user.user_staff_id = user_staff.id WHERE username = '$username' AND password = '$password'"); 
    if($result->num_rows == 1){ 
     $validate = $result->fetch_assoc(); 
     $query1 = "SELECT * FROM usergroup WHERE id = {$validate['user_group_id']}"; 
     if($result1 = $db->query($query1)){ 
      $row1 = $result1->fetch_array(); 
      //change here for the authority 
      $_SESSION['user_staff'] = $validate['displayname']; 
      $_SESSION['usergroup'] = $row1['user_group_type']; 
      echo "<script language='javascript'>window.location='panel.php'</script>"; 
     } else { 
      echo "<script language='javascript'>alert('SQL Error.');</script>"; 
     } 
    } else { 
     echo "<script>alert('Sorry, wrong username and password please check.')</script>"; 
    } 
}