PHP / SQL：从具有良好查询的数据库接收的“false”值

Question

I have a php script who ask my database with PDO to verify if some values sent exists. If they exists, the database respond with the id of this line's value. I tested the query on mysql and it works but the value received is false. This code is only for personal use. There is the code :

<?php
include("../template/pdo.php");
$query = $pdo->prepare("SELECT id_utilisateur FROM utilisateur
      WHERE `mail` IN ( ':mail' )
        AND `mdp` IN ( ':mdp' )");
$query->bindParam(':mail', $_GET['identifiant'], PDO::PARAM_STR);
$query->bindParam(':mdp', $_GET['mdp'], PDO::PARAM_STR);
$success = $query->execute();

if($success)
{
  $result = $query->fetch();
  var_dump($result); //bool(false) actually
  if($result == false){
    $message = "Try again.";
  }
  else{
    $message = "Congratulation !";
  }
}

I tested everything I know :

• $_GET is a print/paste from my database table to my url and i have print him

• Printed/pasted on phpMyAdmin the query from PDOStatement::debugDumpParams() with my $_GET values

• pdo.php work and used on other scripts

• No log in my logs files.

Someone can help me ? Thanks !

Answer 1

• If you are testing against a single value use =, not IN.
• If you have a list of values, several changes are needed.
• The bind code will add quotes, you already have quotes. Remove your quotes.