处理未从准备好的select语句返回任何结果 - Handling no results returned from a prepared select statement

我正在尝试制作一个基本的登录系统。用户在表格中输入用户名+密码，然后张贴并在以下代码中使用：

if(isset($_POST['submit'])) {

$sql = "SELECT username, password FROM tbl_users WHERE username = ? AND password = ?";
$stmt = $mysqli->prepare($sql);
if(!$stmt) {
    die("Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error);
}

$username = $_POST['username'];
$password = $_POST['password'];
var_dump($username);
var_dump($password);

$bind_result = $stmt->bind_param("ss", $username, $password);
if(!$bind_result) {
    echo "Binding failed: (" . $stmt->errno . ") " . $stmt->error;
}
$execute_result = $stmt->execute();
if(!$execute_result) {
    echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
}
$stmt->bind_result($returned_username, $returned_password);
while($stmt->fetch()) {
    var_dump($returned_username);
    var_dump($returned_password);

    if($username === $returned_username && $password === $returned_password) {
        echo "You are now logged in!";
    } else {
        echo "Incorrect username or password";
    }
}

如果我输入正确的用户名和密码，一切都会正常工作，它会正确登录。当我输入错误的信息时，问题就开始出现了，要么是使用了错误的密码，要么是数据库中没有的用户名。"；不正确的用户名或密码"；这条线根本没用。

我对准备好的语句的理解是，一旦绑定了结果，就只能在while循环中使用fetch访问它们。但是，如果没有找到任何结果，则该循环将永远不会运行，因此我无法测试查询是否找到任何结果。

我建议你这样使用它：

if (isset($_POST['submit'])) {
    //Checking, is a user exists with these credentials?
    $sql = "SELECT COUNT(*) AS cnt FROM tbl_users WHERE username = ? AND password = ?";
    $stmt = $mysqli->prepare($sql);
    if (!$stmt) {
        die("Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error);
    }
    $bind_result = $stmt->bind_param("ss", $_POST['username'], $_POST['password']);
    if (!$bind_result) {
        echo "Binding failed: (" . $stmt->errno . ") " . $stmt->error;
    }
    $execute_result = $stmt->execute();
    if (!$execute_result) {
        echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
    }
    $stmt->bind_result($cnt);
    $stmt->fetch();
    if ($cnt > 0) {
        echo "You are now logged in!";
    } else {
        echo "Incorrect username or password";
    }
}

您遇到的问题是基于代码中实现的逻辑。如果没有用户从数据库中检索到，那么检查正确用户名和密码的代码永远不会运行，只需更改几行代码就可以解决这个问题，试试这个：

//this is your code at the moment
while($stmt->fetch()) {
    var_dump($returned_username);
    var_dump($returned_password);

    if($username === $returned_username && $password === $returned_password) {
        echo "You are now logged in!";
    } else {
        echo "Incorrect username or password";
    }
}
//replace that for this
while($stmt->fetch()) {
    var_dump($returned_username);
    var_dump($returned_password);
}
if($username === $returned_username && $password === $returned_password) {
    echo "You are now logged in!";
} else {
    echo "Incorrect username or password";
}

如果你得到任何结果，如果你没有抛出错误，测试一下怎么样：

if($stmt->fetch())
{
   do {
    
        var_dump($returned_username);
        var_dump($returned_password);
    
    
        if($username === $returned_username && $password === $returned_password) {
            echo "You are now logged in!";
        } else {
            echo "Incorrect username or password";
        }
    } while($stmt->fetch());
}
else
{
    echo "Incorrect username or password";
}