使用预准备语句的 PHP 注册脚本 - PHP Registration script using prepared statements

PHP Registration script using prepared statements

本文关键字：PHP 注册脚本语句 | 更新日期: 2023-09-27

我得到了以下注册码，它似乎正在工作，但它实际上并没有将输入的信息插入我的表中。它全部运行，没有显示任何错误，并且显示"echo 'end';"。

编辑，更新代码：现在得到这个错误

警告：mysqli_stmt：：bind_param（）：类型中的元素数定义字符串与中的绑定变量数不匹配 C：''xampp''htdocs''ppa''test.php 在第 19 行

这是这一行：

$insert_stmt->bind_param($email, $password, $random_salt, $user);

.PHP：

   <?php
include "includes/db_connect.php";
if (isset($_POST['email'], $_POST['p'])) {
    $email = $_POST['email'];
    //Default user perms
    $perms = "user";
    $password = hash('sha512', $_POST['p']); //Need to add JavaScript to hash password before it gets here
    //Create random salt
    $random_salt = hash('sha512', uniqid(mt_rand(1, getrandmax()), true));
    //Create salted password
    $password = hash('sha512', $password.$random_salt);
    //Add insert to database script
    //Use prepared statements!
    if ($insert_stmt = $mysqli->prepare("INSERT INTO users (email, password, salt, perms) VALUES (?, ?, ?, ?)")) {
        $insert_stmt->bind_param($email, $password, $random_salt, $perms);
        $insert_stmt->execute();
    }
    echo "Email: ".$email."<br />";
    echo "Password: ".$password."<br />";
    echo "Random Salt: ".$random_salt."<br />";
    echo "Permissions: ".$perms."<br />";
}
?>

这是我db_connect.php页面

<?php
define("HOST", 'localhost');
define("USER", 'ppa_user');
define("PASSWORD", 'password');
define("DATABASE", 'ppa');
$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);
if ($mysqli->connect_errno) {
    //No database found, redirect to setup
    $url = "http://".$_SERVER['HTTP_HOST'].'/ppa/setup.php';
    header('Location: '.$url);
}
?>

为了结束这个问题的回答，得出的结论是OP需要使用以下代码：

$insert_stmt->bind_param("ssss", $email, $password, $random_salt, $perms);

替换以下内容：

//Add insert to database script
    //Use prepared statements!
    if ($insert_stmt = $mysqli->prepare("INSERT INTO users (email, password, salt, perms) VALUES (?, ?, ?, ?)"));
    $insert_stmt->bind_param('ssss', $_POST['email'], $password, $random_salt, $user);
//Execute the prepared query
$insert_stmt->execute();
echo "end";

跟：

//Add insert to database script
//Use prepared statements!
if ($insert_stmt = $mysqli->prepare("INSERT INTO users (email, password, salt, perms) VALUES (?, ?, ?, ?)")) {
    $insert_stmt->bind_param($_POST['email'], $password, $random_salt, $user);
    $insert_stmt->execute();
    echo "end";
}

检查这个

if ($insert_stmt = $mysqli->prepare("INSERT INTO users (email, password, salt, perms) VALUES (?, ?, ?, ?)"));
$insert_stmt->execute(array($_POST['email'], $password, $random_salt, $user));