具有 MySQLi 扩展问题的自定义函数

Question

我真的不知道下面写的查询应该有什么问题

$username是表单通过POST方式传递，$mysqli为连接变量，代码：

$mysqli = new mysqli("127.0.0.1", "root", "", "securelogin");

function usernameCheck($username, $mysqli) {
        $query = "SELECT username FROM user WHERE username = '$username'";
        $stmt = $mysqli->prepare($query)
        $stmt->execute();
        $stmt->store_result();
        if($stmt > 1) {
            $stmt->close();
            return FALSE;
        }
}

此函数检查用户名是否已存在于数据库中

~~~~

我已经用下面的代码解决了这个函数

function usernameCheck($username, $mysqli) {
    $query = "SELECT `username` FROM `user` WHERE `username` = '$username'";
    $result = $mysqli->query($query);
    if($result->num_rows != 0) {
        return FALSE;
    }
}

但是，正如您所说，SQL 注入易受攻击。我只是不明白如何将其编码为不可注射

Answer 1

您的查询容易受到 sql 注入的影响。请正确使用prepare语句。

$query = 'select username from user where username = ?';
$stmt = $mysqli->prepare($query);
$stmt->bind_param('s', $username);
$stmt->execute() or die('error: ' . $mysqli->error);
$stmt->bind_result($username);
return $stmt->fetch();

Answer 2

使用 mysqli 准备好的语句。

 function usernameCheck($username, $mysqli) {

     $query = "select username from user where username =?";
     $stmt = $mysqli->prepare($query);
     $stmt->bind_param('s', $username);
     $stmt->execute() or die('error: ' . $mysqli->error);
     $stmt->store_result();
     $num_of_rows = $stmt->num_rows;  
     $stmt->bind_result($username);
     $stmt->fetch();

     if ($num_of_rows == 0) {
        return false;
     }
   return true;
}