PHP的mysqli不准备准备发言

Question

，所以我有一个登录页面，它工作得非常好使用PHP mysqli的，但它是不可做准备，所以我通常用mysqli_real_escape保护数据。

但我现在迁移到使用事先准备好的声明，有管理这与我的注册页面，并以此作为很好地工作。

这里是我不准备登录代码：

 $loginQuery = "select * from user where user_name = '$user_name' AND password = '$password'"; 
     $result = mysqli_query($con,$loginQuery); 
     if(mysqli_num_rows($result)){ 

       $row = mysqli_fetch_array($result); 

    // password verify 
if (password_verify($password, $row['password'])) { 

       $_SESSION['user_id'] = $row['id']; 
       $_SESSION['user_name'] = strtoupper($row['user_name']); 
       $user_type = strtolower($row['user_type']); 
       if(strtolower($user_type) == 'member'){ 

        $_SESSION['user_type'] = 'member'; 
        //header('Location: member-dashboard-home.php'); 
        header('Location: profile.php'); 

       }elseif(strtolower($user_type) == 'admin' || strtolower($user_type) == 'leader'){ 

        $_SESSION['user_type'] = strtolower($user_type);           
        //header('Location: admin-dashboard-home.php'); 
        header('Location: profile.php'); 
       } 


     }else{ 
       $_SESSION['main_notice'] = "Invalid login details!"; 
       header('Location: '.$_SERVER['PHP_SELF']);exit(); 
     } 

及以下是我在使用事先准备好的声明的努力。

 $stmt = $mysqli->prepare("SELECT user_name FROM user WHERE user_name = ? "); 
    $stmt->bind_param('s', $user_name); 
    $stmt->execute(); 
    $stmt->bind_result($user_name); 
     if($res = $stmt->num_rows()){ 

     $row = $stmt->fetch_array($res); 

    // password verify 
    if (password_verify($password, $row['password'])) { 

       $_SESSION['user_id'] = $row['id']; 
       $_SESSION['user_name'] = strtoupper($row['user_name']); 
       $user_type = strtolower($row['user_type']); 
       if(strtolower($user_type) == 'member'){ 

        $_SESSION['user_type'] = 'member'; 
        //header('Location: member-dashboard-home.php'); 
        header('Location: profile.php'); 
     // exit; 

       }elseif(strtolower($user_type) == 'admin' || strtolower($user_type) == 'leader'){ 

        $_SESSION['user_type'] = strtolower($user_type);           
        //header('Location: admin-dashboard-home.php'); 
        header('Location: profile.php'); 
     //exit; 
       } 

    }else{ 
       $_SESSION['main_notice'] = "Invalid username OR password details, please try again!"; 
       header('Location: '.$_SERVER['PHP_SELF']);exit(); 
      }  
} 

我没有得到任何错误代码，当我试图登录，但形式只是返回的空白，并没有重定向到用户配置文件。

我不认为这是重定向问题还是它呢？

我不我安排$stmt正确，希望你的人看看我能不能。

在此先感谢

Answer 1

从您的评论，

i did include at the top and i receive this error Notice: Undefined variable: mysqli in /home/connection.php... ...

看看你的代码在这里，

$con = new mysqli("localhost", "***", "***", "***"); 
if ($mysqli->connect_errno) { 
    ^^^^^^^^^^^^^^^^^^^^^^ 
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error; 
              ^^^^^^^^^^^^^^^^^^^^^^   ^^^^^^^^^^^^^^^^^^^^^^ 
} 

你连接处理器$con，不$mysqli，它应该是这样的：

$con = new mysqli("localhost", "***", "***", "***"); 
if ($con->connect_errno) { 
    echo "Failed to connect to MySQL: (" . $con->connect_errno . ") " . $con->connect_error; 
} 

更新（1）：更改代码以下列方式，

$stmt = $con->prepare("SELECT * FROM user WHERE user_name = ? "); 
$stmt->bind_param('s', $user_name); 
$stmt->execute(); 
$result = $stmt->get_result(); 
if($result->num_rows){ 
    // username exists 
    $row = $result->fetch_array(); 

    // your code 

}else{ 
    // username doesn't exist 

    // your code 

}