mysql_real_escape_string() 的问题

Question

几天前我开始学习编码，我遇到了 mysql_real_escape_string 的一些问题，特别是 login.php。

错误信息：

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'elegant'@'localhost' (using password: NO) in /home/elegant/public_html/php/login.php on line 3

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the     server could not be established in /home/elegant/public_html/php/login.php on line 3

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'elegant'@'localhost' (using password: NO) in /home/elegant/public_html/php/login.php on line 4

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/elegant/public_html/php/login.php on line 4
Please enter a username and a password

这是我目前的代码——这段代码在 localhost 中工作，但是一旦我把它放到网上并导入数据库表，它给了我一些问题：

<?php

$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);

if ($username&&$password)

{

$connect = mysql_connect("localhost","elegant_root","password;1") or die("Couldn't             connect!");
mysql_select_db("elegant_ezworkstation") or die("Couldn't find database");

$query = mysql_query("SELECT * FROM users WHERE username=$username");

$numrows = mysql_numrows($query);

if ($numrows!=0)
{

while ($row = mysql_fetch_assoc($query))
{

    $dbusername = $row['username'];
    $dbpassword = $row['password'];

}

if ($username==$dbusername&&$password==$dbpassword)
{

    echo "You're in";

}
else
    echo "Incorrect password!";

}
else
die("That user doesn't exist");

}

else
die("Please enter a username and a password");

?>

编辑：我更改为 mysqli，但出现以下错误：

Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given in /home/elegant/public_html/php/login.php on line 3

Warning: mysqli_real_escape_string() expects exactly 2 parameters, 1 given in /home/elegant/public_html/php/login.php on line 4

Answer 1

在连接到数据库后输入mysql_real_escape_string() 会正常工作。

但是，您应该切换到 mysqli 或 PDO。 MySQL 现在已弃用。 几个链接可以帮助你

1. Moving from mysql to mysqli or pdo?
2. mysqli or PDO - what are the pros and cons?

mysqli 和 PDO 中用于转义的等效命令分别为 mysqli_real_escape_string() 和 PDO::quote()。

正如人们所指出的，PDO 绝对是更好的选择。这是我之前写的比较 PDO 与其他人的答案。

PDO - real facts and best practice?

这样做的另一个好处是，如果您使用带有命名参数的准备好的语句，则不需要使用转义函数。