不使用@或从数据库中读取电子邮件

Question

I'm trying to recall data from database to post later on

When someone logs in using this code:

    function login($email, $password, $mysqli)
    {
        // Using prepared statements means that SQL injection is not possible. 
        if ($stmt = $mysqli->prepare("SELECT id, username, password, salt, phnumber, realname, age, sex FROM members WHERE email = ? LIMIT 1")) {

            $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
            $stmt->execute();    // Execute the prepared query.
            $stmt->store_result();

            // get variables from result.
            $stmt->bind_result($user_id, $username, $db_password, $salt, $phnumber, $realname, $age, $sex);
            $stmt->fetch();
             }
     }

Then I set variables for email and name using this code:

$realname = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $realname);        
$_SESSION['realname'] = $realname;
$email = preg_replace("/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}\b/", "", $email);        
$_SESSION['email'] = $email;

Then when I recall all the variables using print_r($_SESSION); The email is posted without @ or . for example: johnsmithyahoocom and also the name is posted without space like JohnSmith Which is undesirable.
How can I make it post the right email form and space between names?

Answer 1

Why are you using preg_replace?

And I would recommend, if you are already using a database, to store only the users ID in the SESSION and fetch the other data from the database, when you need the users Information.