PHP 和 mysql 的 select 出现奇怪的错误

Question

我是网页设计的初学者，我遇到了这个问题。我正在尝试创建登录页面，但是当我尝试创建登录时，它会抛出如下错误:

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':username and passwordhash=:passwordhashed)' at line 1

带有 php 代码

Try { 
//    $SQL = 'INSERT INTO Passwords (username, password, passwordhashed) VALUES (:username,:password,:passwordhashed);';
$username = $_REQUEST['username'];
$password = $_REQUEST['password'];
$PasswordHashed = sha1($password);
echo "Username: ". $username ."<br> Password: ". $password . "<br> PasswordHashed: " . $PasswordHashed;
$SQL = null;
$SQL = "SELECT * FROM BlaBla WHERE (username=:username and passwordhash=:passwordhashed);";
$Statement = $MySQL->prepare($SQL);
$Statement->bindValue(':username', $username);
$Statement->bindValue(':passwordhashed', $PasswordHashed);
$Statement->execute();
$Statement = $MySQL->query($SQL);
if ($Statement->rowCount() < 1 ) {
    echo 'NOPE';
} else {
    echo 'welcome back '. $username;
}

} catch(PDOException $e) {
$ErrorTitle = 'Error';
$Error = "error writing to database";
$ErrorInfo = '<p>Please contact administrator at stephan.littel@stecasso.nl</p> <br> <p>'. $e->getMessage() . '</p>';
include './HTML/Error.php';
exit();
}

我不知道错误是什么。有人可以帮助我吗？

Answer 1

这里:

$Statement = $MySQL->prepare($SQL);
   ^---your prepared statement
$Statement->bindValue(':username', $username);
$Statement->bindValue(':passwordhashed', $PasswordHashed);
$Statement->execute();
$Statement = $MySQL->query($SQL);
                        ^----raw queries have no placeholders

您准备一个语句并执行它。但随后您使用相同的 SQL 执行 RAW 查询，替换准备好的版本的结果。您不能在这样的原始查询中使用占位符。因此你的错误。

最后的 ->query() 调用是无用且多余的。