Mysqli只获取一行/属性[重复]

Question

This question already has an answer here:

• check if row exists with mysql 3 answers

I have a table of users in the database, each user has an id, firstname, lastname, username and a password attribute.

I am trying to create a simple login page and I need to check if the entered password is correct for entered username.

My query looks like that:

$conn = new mysqli($servername, $username, $password, $dbname);
$conn->set_charset("utf8");

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$sql = 'SELECT password FROM users WHERE username = "something"';
$result = $conn->query($sql);

Query should return a password for a specified user but I don't know how to get it.

$result->fetch_array() returns nothing in my case.

</div>

Answer 1

You're thinking about this slightly the wrong way.

There's no need to retrieve the password and then interrogate it in PHP. You can just interrogate it in your query and see if you end up with a row or not.

Furthermore, it's wise to use prepared statements to protect against potentially malicious user input.

$sql = 'SELECT id FROM users WHERE username = ? && password = ?';
if ($stmt = $conn->prepare($sql)) {
    $stmt->bind_param("ss", $_POST['username'], $_POST['password']); //<-- for example
    $stmt->execute();
    $stmt->store_result();
    if ($stmt->num_rows === 1) {
        //good login
    } else {
        //bad login
    }
    $stmt->close();
} else
    die('DB problem...');