php - 为什么数据不显示 php mysql

Question

尝试在index.php上显示数据，用户名工作正常，但电子邮件未显示。

服务器.php

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$results = mysqli_query($db, $query);
if (mysqli_num_rows($results) == 1) {


  $_SESSION['email'] = $email;
  $_SESSION['username'] = $username;
  $_SESSION['success'] = "You are now logged in";
  header('location: index.php');

index.php

<?php
// Echo session variables that were set on previous page
echo "Your email is: " . $_SESSION['email'] . "<br>";
echo "Your username is: " . $_SESSION['username'] . "";
?>

Answer 1

查询数据后您没有获取结果。使用mysqli_fetch_assoc

请注意我已申请mysqli_real_escape_string到您的 WHERE 条件参数，以解决 SQL 注入(inject)相关问题。 Although it is not a fool-proof solution!

更改为以下内容:

$query = "SELECT * 
          FROM users 
          WHERE username = '" . mysqli_real_escape_string($db, $username) . 
          " AND password = '" . mysqli_real_escape_string($db, $password) . "'";
$results = mysqli_query($db, $query);
if (mysqli_num_rows($results) == 1) {

  $row = mysqli_fetch_assoc($db, $results);
  $_SESSION['email'] = $row['email'];
  $_SESSION['username'] =  $row['username'];
  $_SESSION['success'] = "You are now logged in";

请阅读how to prevent SQL injection related issues using Prepared Statements .