PHP表单不会将值插入DB

Question

我遇到了一个我创建的表单的问题(仅限测试目的,我知道它易受SQL注入攻击)

基本上,表单不会插入到DB中,但它似乎在脚本上返回true.

代码如下:

form.php的

   <form action="create.php" method="post">
        <p>Username: <input type="text" name="username" />
        </p>
        <p>Password: <input type="password" name="password" />
        </p>
        <p><input type="submit" value="Create" name= "cre" />
        </p>
    </form>

create.php

<?php
session_start();
$dbname = "obsidian";

if(isset($_POST['cre'])){


    $username = $_POST['username'];
    $password = $_POST['password'];

    $mysqli = new mysqli('localhost','admin1', 'password1','obsidian' ) or die('Failed to connect to DB' . $mysqli->error );

    $hashed_password = password_hash($password,PASSWORD_DEFAULT);

         $registerquery = "INSERT INTO users (username, hash) VALUES('$username', '$hashed_password')";
        if($registerquery = true)
        {
            echo "<h1>Success</h1>";
            echo "<p>Your account was successfully created. Please <a href=\"index.php\">click here to login</a>.</p>";
        }
        else
        {
            echo "<h1>Error</h1>";
            echo "<p>Sorry, your registration failed. Please go back and try again.</p>";    
        }       
     }   


  ?>

我得到了成功消息,但正如我所说,这些值不会插入到数据库中.

任何帮助都会很好.

Answer 1

这定义查询,但不运行它:

 $registerquery = "INSERT INTO users (username, hash) VALUES('$username', '$hashed_password')";

这不是"测试"成功的标志.它只是将变量视为true:

    if($registerquery = true)

=是赋值,==是用于相等测试.