Php登錄表格錯誤行

-4

<?php 
session_start(); 
include_once ('connection.php'); 

if (isset($_POST['login'])){ 
    $uemail = $_POST['email']; 
    $upassword = $_POST['password']; 
} 

    $query = "SELECT * FROM users WHERE email = $uemail and password = $upassword"; 
    $result = mysqli_query($connection, $query); 


    if(mysql_num_rows($query) == 1){ 
     $_SESSION['email'] = $email; 
     header('Location: newfeeds.php'); 
     exit(); 

     }else{ 
     while ($row = mysql_fetch_assoc($result)) { 
     echo $row["email"]; 
     echo $row["password"]; 
     } 
    } 
    ?>

我有PHP手冊它說停止使用SQL和替換sqli但沒有工作。它拋出一個錯誤。Php登錄表格錯誤行

Connected Successfully Fatal error: Call to undefined function mysql_num_rows() in D:\XAMPP\htdocs\codeinventor\login.php on line 14

來源

2016-03-15 Alzira Barretto

更改爲mysqli_num_rows（）。您的查詢不安全或不安全。查看準備好的語句 –

另請參閱http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php?rq=1 – MECU

[您的腳本存在SQL注入攻擊的風險。 ]（http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php） –

將所有mysql_ *函數更改爲mysqli_ *函數。

來源

2016-03-15 17:06:56 MECU

你不能一起使用mysql和mysqli。它們是獨立的API，它們創建的資源互不兼容。所以替換mysql_*與mysqli_*將有所幫助！

來源

2016-03-15 17:13:50

我同意所有在這裏你應該把所有的mysql_ *函數改成mysqli_ *函數。

給你的代碼與MySQL API。請使用以下代碼：

<?php 
session_start(); 
include_once ('connection.php'); 

if ($_SERVER['REQUEST_METHOD'] === 'POST') { 

    if ($_POST['email'] != "" AND $_POST['password'] != ""){ 

     $uemail = $_POST['email']; 
     $upassword = $_POST['password']; 

     $query = "SELECT * FROM users WHERE email = '$uemail' and password = '$upassword'"; 

     $result = mysqli_query($connection, $query); 

     if(mysql_num_rows($query) == 1){ 

     $_SESSION['email'] = $email; 
     header('Location: newfeeds.php'); 
     exit(); 

     }else{ 

     while ($row = mysql_fetch_assoc($result)) { 

      echo $row["email"]; 
      echo $row["password"]; 

     } 
     } 
    }else{ 

    echo "mail or password is not valid"; 
    } 

}else{ 

echo "The form has been not submitted"; 

} 


    ?>

如果一個用戶輸入以下字符串作爲用戶名：

' or uid like '%admin%

您的查詢將是這樣的：

$query = "SELECT * FROM users WHERE email = '' or uid like '%admin%' and password = '$upassword'";

，這就是爲什麼我們告訴你你必須將所有的mysql_ *函數改爲mysqli_ *函數。

來源

2016-03-15 17:25:31 Basti

Php登錄表格錯誤行

回答

相關問題