检查条件下是否存在行（PDO，准备？？？）

Question

下面的代码表明我尝试根据代码中给出的条件来找出是否存在一行。它默认为 else 语句，正确，但如果 if 语句似乎为真（没有电子邮件为 ashfjks@sdhja.com），则不能与“if”语句一起使用，并且相反，代码继续。这段代码的后半部分主要是对情况进行扩展。该行只能存在或不存在，所以我不明白为什么它不严格执行其中一个。我正在转换为站点安全的 PDO，这就是为什么不是所有的都在 PDO 中。如果这个问题过于本地化，我很抱歉？

$stmt = $pdo->prepare("SELECT * FROM table WHERE email = ?");
$stmt->execute(array("$email"));
$row3 = $stmt->fetch(PDO::FETCH_ASSOC);

while($row = $stmt->fetch()) {

  if ( ! $row3) {
    // Row3 doesn't exist -- this means no one in the database has this email, allow the person to join
    $query = "INSERT INTO table (username, email, password, join_date) VALUES ('$username', '$email', SHA('$password1'), NOW())";
    mysqli_query($dbc, $query); 
    $query = "SELECT * FROM table WHERE username = '$username'";
    $data2 = mysqli_query($dbc, $query);
  while ($row = mysqli_fetch_array($data2)) {

  $recipent = '' . $row['user_id'] . '';

    $query = "INSERT INTO messages (recipent, MsgTit, MsgR, MsgA, sender, time, readb, reada, MsgCon) VALUES ('$recipent', '$MsgTit', '$MsgR', '$MsgA', '$sender', NOW(), '$readb', '$reada', '$MsgCon')";
    mysqli_query($dbc, $query);

    // Aftermath.
    echo '<p>Your new account has been successfully created. You\'re now ready to <a href="game2.php" target="_blank">log in</a>. After this you should implement basic character-details on your users profile to begin the game.</p>';

    mysqli_close($dbc);
    exit();
  } }  
  else {
    // An account already exists for this email, so display an error message
    echo '<p class="error">An account already exists for this e-mail.</p>';
    $email = "";
  }
}

Answer 1

您的if 语句将永远不会被执行。您需要检查返回的行数。这就是你想要的：

注意：我最初使用$stmt->rowCount()，但 OP 说这对他不起作用。但我很确定该错误的原因来自其他地方。

if (!($stmt = $pdo->prepare("SELECT * FROM table WHERE email = ?"))) {
   //error
}

if (!$stmt->execute(array("$email"))) {
    //error
}
//The $row3 var you had was useless. Deleted that.

$count = 0;

while ($row = $stmt->fetch()) {
    $count++;
}

//The query returned 0 rows, so you know the email doesn't exist in the DB
if ($count== 0) {

    $query = "INSERT INTO table (username, email, password, join_date) VALUES ('$username', '$email', SHA('$password1'), NOW())";

    if (!mysqli_query($dbc, $query)) {
        //error
    }

    $query = "SELECT * FROM table WHERE username = '$username'";

    if (!($data2 = mysqli_query($dbc, $query))) {
        //error
    }

    while ($row = mysqli_fetch_array($data2)) {

        $recipent = '' . $row['user_id'] . '';

        $query = "INSERT INTO messages (recipent, MsgTit, MsgR, MsgA, sender, time, readb, reada, MsgCon) VALUES ('$recipent', '$MsgTit', '$MsgR', '$MsgA', '$sender', NOW(), '$readb', '$reada', '$MsgCon')";

        if (!mysqli_query($dbc, $query)) {
            //error
        }

       // Aftermath.
       echo '<p>Your new account has been successfully created. You\'re now ready to <a href="game2.php" target="_blank">log in</a>. After this you should implement basic character-details on your users profile to begin the game.</p>';

       mysqli_close($dbc);
       exit();
   }
}
//The query did not return 0 rows, so it does exist in the DB
else {
    // An account already exists for this email, so display an error message
    echo '<p class="error">An account already exists for this e-mail.</p>';
    $email = "";
}

您应该将其余的查询完全转换为使用 PDO。

Answer 2

+1 来自@Geoff_Montee 的回答，但这里还有一些提示：

• 确保在每次 prepare() 或 execute() 之后检查错误。报告错误（但不要将您的 SQL 暴露给用户），然后优雅地失败。

• 请注意，即使您检查了是否存在与 $email 匹配的行，也可能会在您检查后和 INSERT 之前的短时间内创建这样的行。这是race condition。即使您选择匹配 $email 的行，您也应该在数据库中使用 UNIQUE 约束，并在执行 INSERT 时捕获错误，以防 UNIQUE 约束因冲突而阻止插入。

• SELECT email 而不是SELECT *。如果您在电子邮件上有索引，则查询运行效率更高，因为它可以只检查给定值的索引，而不必在不需要时读取表的所有列。这种优化称为仅索引查询。

• 同样使用SELECT user_id 而不是SELECT *。仅当您确实需要获取所有列时才使用SELECT *。

• Bcrypt is more secure than SHA for hashing passwords.