Php 向MySQLi发送变量

我盯着这页看了半个小时，试图找出我的错误。前两个变量被找到并插入数据库，但最后两个变量“email”和“password”没有找到，没有插入数据库，但仍然传递if语句。任何帮助都将不胜感激

Form.php

        <form name="signup" method="POST" action="signup.php">

        <label for="signupFirstName">First Name</label>
        <input type="text" id="signupFirstName" name="signupFirstName" />
        <label for="signupLastName">Last Name</label>
        <input type="text" id="signupLastName" name="signupLastName"/>

        <label for="signupEmail">Email</label>
        <input type="text" id="signupEmail" name="signupEmail" />
        <label for="signupConfirmEmail">Confirm Email</label>
        <input type="text" id="signupConfirmEmail" name="signupConfirmEmail"/>

        <label for="signupPassword">Password</label>
        <input type="text" id="signupPassword" name="signupPassword"/>
        <label for="signupConfirmPassword">Confirm Password</label>
        <input type="text" id="signupConfirmPassword" name="signupConfirmPassword"/>

        <button name="submit" type="submit" >Submit Form</button>

        </form>

名字
姓
电子邮件
确认电子邮件
暗语
确认密码
提交表格

signup.php

     <?php
    if (isset($_POST['signupFirstName']) || isset($_POST['signupLastName']) ||     isset($_POST['signupEmail']) || isset($_POST['signupPassword']) ) {

    echo $_POST['signupEmail'];
    $mysqli = new mysqli('localhost', 'user1', 'password', 'db2');

    /* check connection */
    if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
    }

    $stmt = $mysqli->prepare("INSERT INTO members (First_Name, Last_Name, Email, Password) VALUES (?,?,?,?)");
    $stmt->bind_param('ssss',$sample,$lastName,$email,$password);


    // escape the POST data for added protection
    $sample = isset($_POST['signupFirstName'])
        ? $mysqli->real_escape_string($_POST['signupFirstName'])
        : '';
    $lastName = isset($_POST['signupLastName'])
        ? $mysqli->real_escape_string($_POST['signupLastName'])
        : '';     
    $email = isset($_POST['signupEmail'])
        ? $mysqli->real_escape_string($_POST['signupEmail'])
        : '';
    $password = isset($_POST['signupPassword'])
        ? $mysqli->real_escape_string($_POST['signupPassword'])
        : '';


    /* execute prepared statement */
    $stmt->execute();

    printf("%d Row inserted.\n", $stmt->affected_rows);

    /* close statement and connection */
    $stmt->close();

    /* close connection */
    $mysqli->close();
}
    else{
    echo "broken";
    }
?>

---

在实际设置变量之前，您似乎正在将参数绑定到查询。将

bind_param（）

调用移到

execute（）调用上方

你们也可以重构你们的代码，去掉很多垃圾。示例如下：

<?php
function arr_get($array, $key) {
    if (isset($array[$key])) {
        return $array[$key];
    }

    return '';
}

if (isset($_POST['signupFirstName']) || isset($_POST['signupLastName']) || isset($_POST['signupEmail']) || isset($_POST['signupPassword']) ) {

    echo $_POST['signupEmail'];
    $mysqli = new mysqli('localhost', 'user1', 'password', 'db2');

    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }

    $stmt = $mysqli->prepare("INSERT INTO members (First_Name, Last_Name, Email, Password) VALUES (?,?,?,?)");
    $stmt->bind_param('ssss', arr_get($_POST, 'signupFirstName'), arr_get($_POST, 'signupLastName'), arr_get($_POST, 'signupEmail'), arr_get($_POST, 'signupPassword'));

    /* execute prepared statement */
    $stmt->execute();

    printf("%d Row inserted.\n", $stmt->affected_rows);

    /* close statement and connection */
    $stmt->close();

    /* close connection */
    $mysqli->close();

}
else {
    echo "broken";
}
?>

不转义绑定变量（它不“添加保护”，它只是注入虚假的转义字符）；并在绑定之前设置变量值。在这一点上，我们甚至不会对以纯文本形式存储密码发表评论，直到插入真正起作用为止；但是简单地说，这是非常糟糕的做法