SQL注入保护…语句的第二部分不起作用

Question

My first part of the PHPstatement updates the value accordingly in the database but the 2nd half no longer sets the cookie value, what am I doing wrong, I know its something minor:

    include("db_connect.php");
session_start();
$input_game = $_POST['game'];
$input_user = $_POST['email'];

//$sql = "UPDATE users_table SET Pref_Game = '" . $input_game . "' WHERE Email='" . $input_user . "'";
$stmt = $conn->prepare("UPDATE users_table SET Pref_Game = ? WHERE Email= ?");
$stmt->bind_param("ss", $input_game, $input_user);

2nd half of the statement:

   if( $stmt->execute() ) {
$cookie_name2 = "content";
setcookie($cookie_name2,$input_game, time() + (86400 * 30), "/"); // 86400 = 1 day
} else {
    //Error
}

Can someone shine some light on the issue on to integrate it into the 2nd half of the statement. So it works accordingly.

Answer 1

Wrap the return from execute() in a conditional test. ( execute() returns TRUE on success and FALSE on failure.)

You can also use a prepared statement to run your subsequent query, for example:

if( $stmt->execute() ) {

   $sql="SELECT Pref_Game FROM users_table WHERE Email = ?";
   $stmt2 = $conn->prepare($sql);
   $stmt2->bind_param("s",$input_user);
   $stmt2->execute();
   $pref_game = $stmt2->fetchColumn();
   setcookie($cookie_name2,$pref_game, time() + (86400 * 30), "/"); // 86400 = 1 day
   $stmt2->close();

} else {
   //Error
}

NOTES:

This assumes that Email is unique in users_table. This example code isn't testing whether the $stmt2->execute returns successfully or not, you can wrap that in a conditional test, so we don't fall through to the fetchColumn. If the query is successful, but doesn't return a row, then the fetchColumn. If the query is successful, but doesn't return a row, then the fetchColumn()` will return FALSE.

if( $stmt->execute() ) {

   $sql="SELECT Pref_Game FROM users_table WHERE Email = ?";
   $stmt2 = $conn->prepare($sql);
   $stmt2->bind_param("s",$input_user);
   if ( $stmt2->execute() ) {
       $pref_game = $stmt2->fetchColumn();
       setcookie($cookie_name2,$pref_game, time() + (86400 * 30), "/"); // 86400 = 1 day
   } else {
     // error executing stmt2
   }
} else {
  // error executing stmt
}