php - 在 sql 查询中使用 SESSION 变量时尝试获取非对象的属性

Question

所以我目前正在编写一个系统，当他们登录时，他们会得到一个专门的排名面板。

默认情况下，他们称为用户，而管理员则称为 Admin。

当我尝试验证他们是管理员时。

error_reporting(E_ALL); // i've been trying to find the bugs with this
require_once('db.php'); //using the good ol $conn = new mysqli
session_start();
if(!isset($_SESSION['username']) || empty($_SESSION['username'])){
  header("location: login.php");
  exit;
//to detect if they are logged in or not
}

//here is a failed attempt where I tried to "escape" the $_SESSION variable 
//  which still doesn't work
$username = $conn->real_escape_string($_SESSION['username']);
// I've tried this query with the $_SESSION variable escaped, with it's alias
// etc.
$query1 = "SELECT * FROM `users` WHERE `rank` = Admin AND 
`username`='".$username."'";

// preparing to execute
$result = $conn->query($query1);

// this is where I detect if there is a row, set it to use Admin things 
// which I will code later, for now just var holders.
if ($result->num_rows > 0) {
  $rank = 'Admin';
} else {
  $rank = 'User';
}

我到处查看有关非对象属性的信息，但我只找到 2008 年的旧帖子，我曾尝试实现这些帖子，但最终无法正常工作。

在 PHP 7 中使用 XAMPP (apache)

Answer 1

你需要更正你的SQL

"SELECT * FROM `users` WHERE `rank` = Admin AND `username`='".$username."'"

到

"SELECT * FROM `users` WHERE `rank` = 'Admin' AND `username`='".$username."'"

注意 Admin

之间的单引号

我建议改用下面的 SQL，并将排名值直接存储到 SESSION。

"SELECT rank FROM `users` WHERE `username`='".$username."'"