用简单的PHP MYSQLI QUERY非常奇怪的情况

Question

<?php if (is_array($this->data)): ?>
    <?php foreach ($this->data as $key => $val): ?>
    <?php endforeach; ?>
<?php else: ?>
Error on loading
<?php 
endif; 

global $connect;
# GET DEPOSITS

$user = $_SESSION['username'];
$get_iteme2 = $connect->query("SELECT * FROM users WHERE email = '$user'");
$row = $get_iteme2->fetch_array(MYSQLI_ASSOC);
$u = $row['username'];

$get_ref = $connect->query("SELECT * FROM users WHERE refferal = '$u' ");
$row_depo = $get_ref->num_rows;

$get_itemx = $connect->query("SELECT * FROM users WHERE ref = '$u' AND balance > '0' ");
$row_depx = $get_itemx->num_rows;
$ref_c = $row_depx * 0.01;
?>
<div id="ttt" style="margin:0 auto; width:100%;  height:40px; background:#245e76; text-align:center;  overflow:hidden; border-radius:4px; margin-top:5px;">
<div id="ttt" style="margin:0 auto; width:94%;  height:48px; background:#245e76; text-align:center;  overflow:hidden; border-radius:4px; margin-top:0px;">
<p style="font-size:12px; margin-top:10px; font-family:Arial; color:white; ">Affliate Page is now under maintenance</p> 
</div></div>  </br>  

</table>

</div>
    </div>
  </div>
</div>

This is my code, the strange thing is that $row_depo is not providing the num rows, but if I change in the query the variable $u to a username itself the query works, but the query is reading also the variable $u with the username in itself, it simply does not work if it uses the variable

Answer 1

Try to use $connect->query("...") instead $connect->prepare("...") and when you insert $var in string use {} or concatenate for security.

Help this help:

$get_ref = $connect->query("SELECT * FROM users WHERE refferal = '{$u}'");
$row_depo = $get_ref->num_rows;