無法將PDO查詢轉換為MySQLi

Question

我有一個在PDO中運行良好的查詢，但我需要將該查詢轉換為MySQLi，以便與較舊的服務器兼容。

這是PDO查詢：

$conn = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
$sql = "SELECT * FROM users WHERE username=:username";
$st = $conn->prepare( $sql );
$st->bindValue( ":username", $username, PDO::PARAM_STR );
$st->execute();

while ( $row = $st->fetch() ) {
  $db_username = $row['username'];
  $db_password = $row['password'];
}

這是我要使用MySQLi的功能，但似乎不起作用：

$mysqli = new mysqli( 'localhost', DB_USERNAME, DB_PASSWORD, DB_NAME );
$username = mysqli_real_escape_string($mysqli, $username);
$query = "SELECT * FROM users WHERE username=$username";
if ($result = $mysqli->query($query)) {
while ($obj = $result->fetch_object()) {
  $db_username = $obj->username;
  $db_password = $obj->password;
}
mysqli_free_result($result);
}

任何幫助將不勝感激:)

Answer 1

嘗試使用mysqli准備語句系統

$mysqli = new mysqli( 'localhost', DB_USERNAME, DB_PASSWORD, DB_NAME );

$query = "SELECT username, password FROM users WHERE username=?";
$prep = $mysqli->prepare($query);
$prep->bind_param('s', $username);
$prep->execute();
$result = $prep->get_result(); // Make sure you have mysqlnd installed
if($result) {
    while ($obj = $result->fetch_object()) {
         $db_username = $obj->username;
         $db_password = $obj->password;
    }
mysqli_free_result($result);
}

如果您沒有安裝mysqlnd，那么不太直觀的方法涉及bind_param

$prep->execute();
$prep->bind_result($db_username, $db_password);
$prep->fetch();