mysqli_real_escape_string 和 php 中的 mysqli_num_rows

Question

我的问题计数 sql 。

<input name='d_n[]'> 
<input name='d_n[]'>

php页面

后值亚当的

foreach($ds_director as $key => $director){
  // my problem here //
  $DnumSql = "SELECT * FROM list WHERE ds_name = ?";
  $stmt = $con -> prepare($DnumSql);
  $stmt -> bind_param('s',$director);
  $stmt -> execute();
  $Dnum = $stmt->num_rows;
  echo "$Dnum"; // result again '0'
  /////////////
  if($Dnum == 0){
      $director_sql = mysqli_real_escape_string($con,ucwords($director));
      $Dsql =  "INSERT INTO movie_ds (ds_m_name, ds_name, ds_status) VALUES ('$director_sql', '$m_name', 'yönetmen')";
      $Dquery = mysqli_query($con,$Dsql);

      if($Dquery){
        echo "<p style='color:green'>good</p>";
      }else{
        echo mysqli_error($con);
      }
}else{
     echo "<p style='color:red;'>not save</p>";
}
}

由于这个问题，记录了相同的值

更新问题已编辑 = 数组输入

Answer 1

最好使用prepare statement。它会自动转义你的字符串并防止sql注入

$sql = 'SELECT * FROM list WHERE d_n =?';
$stmt =$con->prepare($sql);
$stmt->bind_param('s', $_POST['d_n']);
$stmt->execute();
$numrows = $stmt->num_rows;