将 PDO 查询转换为 MySQLi 时遇到问题

Question

我有一个在 PDO 中运行良好的查询，但我需要将查询转换为 MySQLi 以与旧服务器兼容。

这里是 PDO 查询：

$conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
$sql = "SELECT * FROM users WHERE username=:username";
$st = $conn->prepare( $sql );
$st->bindValue( ":username", $username, PDO::PARAM_STR );
$st->execute();

while ( $row = $st->fetch() ) {
  $db_username = $row['username'];
  $db_password = $row['password'];
}

这是我对 MySQLi 的要求，但它似乎不起作用：

$mysqli = new mysqli( 'localhost', DB_USERNAME, DB_PASSWORD, DB_NAME );
$username = mysqli_real_escape_string($mysqli, $username);
$query = "SELECT * FROM users WHERE username=$username";
if ($result = $mysqli->query($query)) {
while ($obj = $result->fetch_object()) {
  $db_username = $obj->username;
  $db_password = $obj->password;
}
mysqli_free_result($result);
}

任何帮助将不胜感激:)

Answer 1

尝试使用mysqli准备好的语句系统

$mysqli = new mysqli( 'localhost', DB_USERNAME, DB_PASSWORD, DB_NAME );

$query = "SELECT username, password FROM users WHERE username=?";
$prep = $mysqli->prepare($query);
$prep->bind_param('s', $username);
$prep->execute();
$result = $prep->get_result(); // Make sure you have mysqlnd installed
if($result) {
    while ($obj = $result->fetch_object()) {
         $db_username = $obj->username;
         $db_password = $obj->password;
    }
mysqli_free_result($result);
}

如果您没有安装 mysqlnd，那么不太直观的方法涉及bind_param

$prep->execute();
$prep->bind_result($db_username, $db_password);
$prep->fetch();