php - Mysqli_query 返回 0 行（字符问题？）

Question

我对这个 php 代码有疑问：

<?php
$data = json_decode($_POST['data'], true);
$user = mysqli_real_escape_string($conn, $data['username']);
$password = md5($data['password']);
$query = mysqli_query($conn, 'SELECT * FROM Utenti WHERE username = "$user" AND password = "$password"');
if(mysqli_num_rows($query) > 0){
    $status = 'ok';
} else{
    $status = 'error';
    session_destroy();
}
echo $status;?>

这是请求（json 编码）：

POST /login HTTP/1.1
Host: example
User-Agent: example
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: length

data=%7B%22username%22%3A+%22harry%22%2C+%22password%22%3A+%22potter%22%7D

当我像这样'SELECT * FROM Utenti WHERE username =“harry” AND password =“potter”'这样写查询时，这将返回'error'bur，它返回'ok'。此外，语句 '$user == "harry" 和 $password == "potter" 返回 true。可能是字符编码/json问题吗？

ps 我知道安全问题（md5，http）这只是一个测试

标签： phpmysqljson

Answer 1

如果您用单引号封装您的字符串（您的 SQL 查询），则不会扩展变量。您需要为此使用双引号：

$string = 'user="$user"';
// literally the string: user="$user"

$string = "user=\"$user\"";
// literally the string: user="harry"