Select Statement using prepared and fetching data into array


Select Statement using prepared and fetching data into array

我正在尝试在我的网站上实现一个基本的登录功能。我使用以下代码从数据库中获取数据,看看用户名和密码是否正确:

$STH = $conn->prepare("SELECT * FROM users WHERE uid = '$uid'");
$STH->bindParam(':uid', $uid);
$STH->bindParam(':pass', $pass);
$uid = $_POST['uid'];
$pass = $_POST['pass'];
if($STH->execute()) {
        if($row = $STH->fetch()) {
            if ($row['pass'] == $pass) {
                echo "Logged in Successfully <br>";
                } else {
                    echo "Username or Password Incorrect<br>";
                }
            } else {
                    echo "<script>alert('Incorrect Username');</script>";
            }
        }
}

然而,即使错误Incorrect Username在数据库中,我仍然会得到它。这意味着我在执行查询后获取数据的方式有问题,但我不知道具体是什么。

我错误地使用了准备好的语句。我并没有在查询中绑定任何内容。正确的实施方式是:

$STH = $conn->prepare("SELECT * FROM users WHERE uid = :uid");