PHP/MYSQL Retrieve Name based on another criterion

问题

So I have a login system and I want to retrieve the first name of the person who is logged in. Here's my php:

function verify_Username_and_Pass($un, $pwd) {
        $query = "SELECT `First Name`, Username, Password
                FROM table
                WHERE Username = :un AND Password = :pwd
                LIMIT 1";

        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(':un', $un);
        $stmt->bindParam(':pwd', $pwd);
        $stmt->execute();

        if ($stmt->rowCount() > 0) {
            // User exist
            return true;
            $stmt->close();
        }
        else {
            // User doesn't exist
            return false;
            $stmt->close();
        }
    }

this is part of a class who has 1 private variable $conn. The login works perfectly but i just want to get the person's first name. How do I do that?

回答1:

First off, NEVER grab the password from the database, that is just extremely bad practice.

Second, you only want to accept the user as correct if ONLY one row is returned.

lastly bindColumn is what you're looking for.

<?php
function verify_Username_and_Pass($un, $pwd) {
    $query = "SELECT `First Name`, Username
              FROM table
              WHERE Username = :un AND Password = :pwd";
    // Don't limit the query to only one, if there is a chance that you can
    // return multiple rows, either your code is incorrect, bad data in the database, etc...

    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(':un', $un);
    $stmt->bindParam(':pwd', $pwd);
    $stmt->execute();

    // Only assume proper information if you ONLY return 1 row.
    // Something is wrong if you return more than one row...
    if ($stmt->rowCount() == 1) {
        // User exist
        $stmt->bindColumn('First Name', $firstName);
        $stmt->bindColumn('Username', $username);
        // You can now refer to the firstName and username variables.
        return true;
        $stmt->close();
    } else {
        // User doesn't exist
        return false;
        $stmt->close();
    }
}
?>

That should work for you.

回答2:

just change the query statement?

    $query = "SELECT `First Name`
            FROM table 
            WHERE Username = :un AND Password = :pwd 
            LIMIT 1";

if that throws errors, you would have to show more of what the class is doing to manage the db transaction

回答3:

just change this line, to select only First Name in the query:

 $query = "SELECT `First Name`, Username, Password
            FROM table
            WHERE Username = :un AND Password = :pwd
            LIMIT 1";` 
     to 

 $query = "SELECT `First Name`
            FROM table
            WHERE Username = :un AND Password = :pwd
            LIMIT 1";`

回答4:

You need to bind the result as below

    if ($stmt->rowCount() > 0) {
        $stmt->bind_result($fname, $uname, $pwd);
        $stmt->fetch()
        echo $fname // here you get firsname

        // either you can return this $fname or store into session variable for further

        // User exist
        return true;
        $stmt->close();
    }
    else {
        // User doesn't exist
        return false;
        $stmt->close();
    }

回答5:

In the section where you are returning true you could instead return the actual user data (and array with data will evaluate to true anyway).

Word of warning, you should use hashed passwords. Do not store the password y plain.

来源：https://stackoverflow.com/questions/12695162/php-mysql-retrieve-name-based-on-another-criterion

标签

php

mysql

database

pdo