帮助准备好的陈述
大家好，我最近听说准备好的语句是保护我的网站免受 mysql 注入等攻击的最佳方法。所以我有一个问题，我似乎无法理解为什么这不起作用：
$mysqli=new mysqli("localhost", "***", "***","***") or die(mysql_error());
function checklogin($username, $password){
$result = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$result->bind_param("s", $username);
$result->execute();
我收到以下错误： 注意：未定义的变量：mysqli in /var/www/JMToday/loginchk.php on line 45 Fatal error: Call to /var/www/JMToday/loginchk.php 第 45 行中非对象上的成员函数prepare()
Hey guys, I have recently heard that prepared statements are the best way to secure my website from mysql injections and what not. So I have a question, I can't seem to understand why this does not work:
$mysqli=new mysqli("localhost", "***", "***","***") or die(mysql_error());
function checklogin($username, $password){
$result = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$result->bind_param("s", $username);
$result->execute();
I get the following error: Notice: Undefined variable: mysqli in /var/www/JMToday/loginchk.php on line 45 Fatal error: Call to a member function prepare() on a non-object in /var/www/JMToday/loginchk.php on line 45
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您正在尝试在函数中使用全局变量 ($mysqli)。 （在这种情况下，错误消息“未定义的变量”非常有洞察力。）
您需要：
将该变量声明为全局变量。 （即：添加“
global $mysqli;”作为 checklogin 函数中的第一行。）将 $mysqli 的定义移至 checklogin 函数中。
作为一般建议，我建议阅读 变量范围 部分。
You're attempting to use a global variable ($mysqli) within a function. (The error message "undefined variable" is incredibly insightful in this instance.)
You either need to:
Declare the variable as a global. (i.e.: Add "
global $mysqli;" as the first line within your checklogin function.)Move the definition of $mysqli to within the checklogin function.
As a general bit of advice, I'd recommend reading the variable scope section of the PHP manual.