将 MySQL 登录脚本转换为 PDO

Question

I've written a functional login script using MySQL. However, I've now been told that it needs to be done using PDO, and I've a functional PDO connection:

function getConnection()
{
    $userName = '*****';
    $password = '*****';
    $dbname = '******';
    $db = new PDO("mysql:host=localhost;dbname=$dbname", $userName, $password);
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    return $db;

However I've no idea how to convert the login query to PDO.

if (isset($_REQUEST['attempt']))
{
    $user = $_POST['user'];
    $password = $_POST['password'];

    $qry = mysql_query
        ("SELECT *
          FROM subscriber
          WHERE email = '$user'
          AND password = '$password'")
        or die(mysql_error());

    $total = mysql_num_rows($qry);

    if ($total > 0)
    {
        session_start();
        $_SESSION['user'] = 'yes';
        header('location: account.php');
        exit;
    }
    else
    {
        // Do nothing.
    }
}

How can I do it?

Answer 1

To get you started:

$db = getConnection();
$stmt = $db->prepare("
    SELECT * FROM subscriber WHERE email = :email AND password = :password
");
$stmt->bindParam(":email"   , $user    );
$stmt->bindParam(":password", $password);
$stmt->execute();
$total = $stmt->rowCount();

Answer 2

Non-bloated version:

$stm = $pdo->prepare("SELECT * FROM subscriber WHERE email = ? AND password = ?");
$stm-> execute($_POST['user'], $_POST['password']);
if ($id = $stm->fetchColumn()) {
    session_start();
    $_SESSION['user'] = $id;
    header('location: account.php');
    exit;
}

Answer 3

You can also use this example if you would not like to use bindParam. But I extracted it from @eggyal's answer. Great thanks go to eggyal.

<?php session_start();
    include_once('pdo.inc.php');

    $username = (isset($_POST['username']))? trim($_POST['username']): '';
    $password = (isset($_POST['password']))? $_POST['password'] : '';
    $pas = md5($password);
    $redirect = (isset($_REQUEST['redirect']))? $_REQUEST['redirect'] :
        'view.php';
    $query = ("SELECT username FROM site_user WHERE username=:username
              AND password =:password");
    $query_login = $con->prepare($query);
    $query_login->execute(array(
        ':username'=>$username,
        ':password'=>$pas));
    $result = $query_login->rowCount();

    if($result>0)
    {
        $_SESSION['username'] = $username;
        $_SESSION['logged'] = 1;
        echo "success";
    }
    else {
        // Set these explicitly just to make sure
        echo 'User name invalid';
    }
?>