mysqli_stmt :: bind_result():绑定变量数与预准备语句中的字段数不匹配

Question

我一直在尝试使用预准备语句在PHP中编写登录表单,但每次我尝试登录时都会收到以下错误:

mysqli_stmt :: bind_result():绑定变量数与预准备语句中的字段数不匹配

这是我的代码:

<?php
session_start();

$mysqli = new mysqli("localhost", "root" , "" , "security");
if(mysqli_connect_errno()){
    echo "Wrong" ;
}
if($stmt = $mysqli->prepare("SELECT username AND password FROM users WHERE username =? AND password =?")){
    $username = $_POST['name'];
    $password = $_POST['password'];
    $stmt->bind_param('ss' ,$username ,$password);
    $stmt->execute();
    $stmt->bind_result($password ,$username);
    if($stmt->fetch() == 'true')
    {
        echo "welcome";
    } else{
        echo "wrong password";
    }
}
?>

有人能告诉我为什么会这样吗？

Answer 1

$mysqli->prepare("SELECT username, password FROM users WHERE username = ? AND password = ?");
$username = $_POST['name'];
$password = $_POST['password'];
$stmt->bind_param('ss' ,$username ,$password);
$stmt->execute();
$stmt->bind_result($username ,$password);

您的选择语法错误,正确的语法是 SELECT field1, field2, field3 FROM TABLE WHERE field1 = ? AND field2 = ?

要选择更多字段,只需用逗号分隔,而不是用逗号分隔 AND

另外,我意识到你是用明文保存你的密码,这是不好的做法,考虑使用那里的众多散列函数来散列它们像 sha1()