问题
Okay. So I made a form. If I put in mysql_real_escape_string on my variable $usrname (yes its spelled right) that was retrieved from the form, it returns my other variable, $verify as false. Take a look:
<html>
<body>
<?php
session_start();
include("mainmenu.php");
$usrname = $_POST['usrname'];
$password = sha1($_POST['password']);
$con = mysql_connect("localhost", "root", "Y0U_C@NT_H@NDLE_THE_TRUTH!");
if(!$con){
die("Unable to establish connection with host. We apologize for any inconvienience.");
}
mysql_select_db("users", $con) or die("Can't connect to database.");
$select = "SELECT * FROM `data` WHERE usrname = '$usrname' and
password = '$password'";
$query = mysql_query($select);
$verify = mysql_num_rows($query);
if($verify==1){
$_SESSION["valid_user"] = $usrname;
header("location:index.php");
}
else{
echo "Wrong username or password. Please check that CAPS LOCK is off.";
echo "<br/>";
echo "<a href=\"index.php\">Back to login</a>";
}
mysql_close($con);
?>
</body>
If I put the mysql_real_escape_string in either my registration form or login form, it returns $verify as false. What's wrong?
回答1:
Please make sure "Magic Quotes" is off in the PHP settings. How to disable it is explained here.
来源：https://stackoverflow.com/questions/4675737/mysql-real-escape-string-causes-problems