为什么我的 PHP 代码没有发布到我的 SQL-Database？

Question

我很确定我没有任何错误，但是，当我提交 from 时，我没有像提交成功时那样得到 "Success"。 connect.php 是连接到我的数据库的 php 文件，我没有从中得到任何错误，所以我知道我连接到我的数据库而 header.php 是header。没有什么会导致那里的任何错误。页脚也是一样的。我知道我已连接到我的数据库，因为我之前在测试我的代码时遇到错误，但是，现在我没有收到任何错误，或者 "Success".

这是我的尝试：

<?php
//signup.php
include 'connect.php';
include 'header.php';

echo '<h3>Sign up</h3>';
echo '<form method="post" action="">
    Username: <input type="text" name="user_name" />
    Password: <input type="password" name="user_pass">
    Password again: <input type="password" name="user_pass_check">
    E-mail: <input type="email" name="user_email">
    <input type="submit" value="sign up" />
</form>';
if($_SERVER['REQUEST_METHOD'] === 'POST') {

    $fixed_user_name = $database_connection->real_escape_string($_POST['user_name']);
    $fixed_user_email = $database_connection->real_escape_string($_POST['user_email']);
    $now = NOW();

    $sql = "INSERT INTO users (user_name, user_pass, user_email) 
            VALUES ($fixed_user_name, $_POST['user_pass'], $fixed_user_email)";

    if($database_connection->query($sql) === TRUE){
        echo "Success";
    }
    else {
        echo "Error: " . $sql . "<br>" . $database_connection->error;
    }
}

include 'footer.php';
?>

这也是我的 connect.php 文件：

<?php
//connect.php
$username   = 'root';
$password   = "root_password";
$database   = 'cloud';

$database_connection = new mysqli("localhost", $username, $password, $database);

if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

echo $mysqli->host_info . "\n";

?>

Answer 1

echo '<h3>Sign up</h3>';
echo '<form method="post" action="">
Username: <input type="text" name="user_name" />
Password: <input type="password" name="user_pass">
Password again: <input type="password" name="user_pass_check">
E-mail: <input type="email" name="user_email">
<input type="submit" name="submit" value="sign up" />
</form>';
if(isset($_POST['submit'])) {

$fixed_user_name = $database_connection->real_escape_string($_POST['user_name']);
$fixed_user_email = $database_connection->real_escape_string($_POST['user_email']);
$now = NOW();

$sql = "INSERT INTO users (user_name, user_pass, user_email) 
        VALUES ('$fixed_user_name', '".$_POST['user_pass']."', '$fixed_user_email')";

$result = mysqli_query(whatever your connection variable is, $sql);

if($database_connection->query($sql) === TRUE){
    echo "Success";
}
else {
    echo "Error: " . $sql . "<br>" . $database_connection->error;
}
}

Answer 2

这是使用 password_hash() 和准备语句的更安全的脚本方式：

signup.php

<?php
//signup.php

#include "connect.php"; // set $servername, $username, $password and $dbname there

include 'header.php';

// changed here the '' to "" and back
echo "<h3>Sign up</h3>".
    "<form method='post' action=''>
        Username: <input type='text' name='user_name' />
        Password: <input type='password' name='user_pass'>
        Password again: <input type='password' name='user_pass_check'>
        E-mail: <input type='email' name='user_email'>
        <input name='submit' type='submit' value='sign up' />
     </form>";

if(isset($_POST["submit"])) {

    include "connect.php";

    // set the user_name and user_email as a seperate variable
    $username = $_POST["user_name"];
    $email = $_POST["user_email"];
    $password = $_POST["user_pass"];
    $cpassword = $_POST["user_pass_check"];

    $fixed_user_name = mysqli_real_escape_string($conn, $username);

    $fixed_user_email = mysqli_real_escape_string($conn, $email);

    #$now = NOW();

    //check if password is not cpassword and if so, there is an error
    if ($password !== $cpassword) {
        echo "Passwords do not match!";
    }

    //NEVER store PLAINTEXT PASSWORDS... user php build_in functions like password_hash() and store only the hash
    $hash = password_hash($password, PASSWORD_DEFAULT);

    //change your db_entry user_pass to hash
    $sql = $conn->prepare("INSERT INTO users (user_name, hash, user_email) VALUES (?, ?, ?)");
    $sql->bind_param("sss", $fixed_user_name, $hash, $fixed_user_email);
    $sql->execute();

    echo "Success!";

    $sql->close();
    $conn->close();

}
include 'footer.php';
?>

connect.php

<?php
//connect.php
$servername = "localhost";
$username   = "root";
$password   = "root_password";
$dbname   = "cloud";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
?>

解释在带有注释的脚本中:)

查看 php.net manual 的 password_hash() 函数

也许这对你有帮助

为什么我的 PHP 代码没有发布到我的 SQL-Database？

Why isn't my PHP code posting to my SQL-Database?

php

mysql

password-protection

password-hash