我正在努力用PDO升级登录脚本

Question

我的函数中有一个自定义的query（）函数。 文件。 我创建了一个login.php文件，但是当我执行SQL查询时，query（）函数返回一个PDO对象，而不是我想要的关联数组。 我需要帮助传递参数以将其绑定到存储过程/准备好的语句。

以下是login.php文件：

<?php

    // configuration
    require("../../includes/config.php");

    // if form was submitted
    if ($_SERVER["REQUEST_METHOD"] == "POST")
    {
        // validate submission
        if (empty($_POST["username"]))
        {
            adminapologize("You must provide your username.");
        }
        else if (empty($_POST["password"]))
        {
           adminapologize("You must provide your password.");
        }

        $username = $_POST["username"];

        // query database for user
        $sql = "SELECT * FROM admin WHERE username = '$username'";

        $result = query($sql,array($username));        
        //var_dump($result);
        //exit;

        if($sql != false)
        {
            if($result->rowCount() == 0)
            {
                printf("No admin yet.");
            }

            // if we found user, check password
            if($result->rowCount() == 1)
            {
                // first (and only) row
                $row = $result->fetch();

                // compare hash of user's input against hash that's in database
                if ($_POST["username"] == $row["username"] && crypt($_POST["password"], $row["hash"]) == $row["hash"])                 
                {
                    // remember that user is now logged in by storing user's ID in session
                    $_SESSION["admin_id"] = $row["admin_id"];

                    // redirect to admin home
                    redirect("index.php");
                }
            }
        }
        else
        {
            // else apologize
            adminapologize("Invalid username and/or password.");
        }
    }
    else
    {
        // else render form
        adminrender("login_form.php", ["title" => "Admin Log In"]);
    }

?>

建议config.php包含functions.php文件。 以下是functions.php文件的一部分：

/**
* Executes SQL statement, possibly with parameters, returning
* a pdo statement object on success, handling and halting execution on error.
*/

function query($sql, $parameters = null)
{
    static $pdo; // define the var as static so that it will persist between function calls
    try
    {
        // if no db connection, make one
        if (!isset($pdo))
        {
            // connect to database
            // you should set the character encoding for the connection
            $pdo = new PDO("mysql:dbname=" . DB_NAME . ";host=" . DB_SERVER, DB_USERNAME, DB_PASSWORD);
            $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // set the error mode to exceptions
            $pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES,false); // turn emulated prepares off
            $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE,PDO::FETCH_ASSOC); // set default fetch mode to assoc so that you don't have to explicitly list the fetch mode every place
        }

        if(empty($parameters))
        {
            // no bound inputs
            $stmt = $pdo->query($sql);
        } else {
            // has bound inputs
            $stmt = $pdo->prepare($sql);
            // you should use explicit bindValue() statements to bind any inputs, instead of supplying them as a parameter to the ->execute() method. the comments posted in your thread lists the reasons why.
            $stmt->execute($parameters);
        }
    }
    catch (Exception $e)
    {
        // all errors with the connection, query, prepare, and execute will be handled here
        // you should also use the line, file, and backtrace information to produce a detailed error message
        // if the error is due to a query, you should also include the $sql statement as part of the error message
        // if $pdo ($handle in your code) is set, it means that the connection was successful and the error is due to a query. you can use this to include the $sql in the error message.
        trigger_error($e->getMessage(), E_USER_ERROR);

        //exit; // note: E_USER_ERROR causes an exit, so you don't need an exit; here.
    }

    return $stmt; // if the query ran without any errors, return the pdo statement object to the calling code

}

您的帮助将不胜感激。

Answer 1

您拥有出色的功能，无需破坏它。

query（）函数返回一个PDO对象，而不是我想要的一个关联数组。

它实际上是您要返回的对象。 至于数组，您只需将获取链接到调用即可获得它：

$result = query($sql,array($username))->fetch();   // voila!

通过函数返回一个对象，您不仅可以获得单行，而且可以获得数十种不同的结果。 类似于具有fetchColumn()单列值或fetchAll()支持的多种格式。 更不用说您可以从对象中获取numRows（），而不能从数组中获取。

使用当前功能的该函数，您还可以运行DML查询，而返回fetch则会导致错误。 返回对象是一件非常酷的事情！

关于函数的唯一不好的事情是，您正在捕获一个异常并将其手动转换为错误， 而PHP已经为您完成了。
只需摆脱try try catch块，您将获得完全相同（实际上甚至更好）的错误报告。

    // all errors with the connection, query, prepare, and execute will be handled here
    // you should also use the line, file, and backtrace information to produce a detailed error message
    // if the error is due to a query, you should also include the $sql statement as part of the error message
    // if $pdo ($handle in your code) is set, it means that the connection was successful and the error is due to a query. you can use this to include the $sql in the error message.

如果您根本没有遇到异常，那么PHP已经为您做了所有这些事情。

（保存用于存储实际不需要的$ sql变量，因为您可以在回溯之后找到查询）

在代码中，它应该短五倍：

    $sql = "SELECT * FROM admin WHERE username = ?";
    $row = query($sql,array($username))->fetch();
    if($row && crypt($_POST["password"], $row["hash"]) == $row["hash"])
    {
         // remember that user is now logged in by storing user's ID in session
         $_SESSION["admin_id"] = $row["admin_id"];

         // redirect to admin home
         redirect("index.php");

         //this is essential as otherwise anyone will be able to proceed with this page
         exit;
    }

顺便说一句，我只是注意到您使用了错误的函数，直接向查询中发送了$ username。 我也修好了。

Answer 2

根据@您的常识的答案进行编辑谁是绝对正确的：调用函数“查询”并直接对结果进行提取。 例如，如以下注释中所述：

$rows = query($sql, $params)->fetch();

如果您想将行作为关联数组

$rows = query($sql, $params)->fetch(PDO::FETCH_ASSOC);

这将显式返回一个关联数组。

您必须在执行后获取结果。

$stmt->execute($parameters);
return $stmt->fetch(PDO::FETCH_ASSOC);

这应该返回一个关联数组。

另请参阅： http : //php.net/manual/de/pdostatement.fetch.php

/**
 * Executes SQL statement, possibly with parameters, returning
 * a pdo statement object on success, handling and halting execution on  error.
 */

function query($sql, $parameters = null)
{
    static $pdo; // define the var as static so that it will persist between function calls
    $return = false;
try {
// if no db connection, make one
    if (!isset($pdo)) {
    // connect to database
    // you should set the character encoding for the connection
    $pdo = new PDO("mysql:dbname=" . DB_NAME . ";host=" . DB_SERVER, DB_USERNAME, DB_PASSWORD);

    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // set the error mode to exceptions

    $pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES,false); // turn emulated prepares off

    $pdo->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE,PDO::FETCH_ASSOC); // set default fetch mode to assoc so that you don't have to explicitly list the fetch mode every place

}

if(empty($parameters)){
    // no bound inputs
    $stmt = $pdo->query($sql);
} else {
    // has bound inputs
    $stmt = $pdo->prepare($sql);
     // you should use explicit bindValue() statements to bind any inputs, instead of supplying them as a parameter to the ->execute() method. the comments posted in your thread lists the reasons why.
        $stmt->execute($parameters);
        $return = $stmt->fetch(PDO::FETCH_ASSOC);
    }    
} catch (Exception $e)

{
// all errors with the connection, query, prepare, and execute will be handled here
// you should also use the line, file, and backtrace information to produce a detailed error message
// if the error is due to a query, you should also include the $sql statement as part of the error message
// if $pdo ($handle in your code) is set, it means that the connection was successful and the error is due to a query. you can use this to include the $sql  in the error message.
    trigger_error($e->getMessage(), E_USER_ERROR);
    //exit; // note: E_USER_ERROR causes an exit, so you don't need an exit;     here.
}

return $return; // if the query ran without any errors, return the pdo statement     object to the calling code