0

这是我的代码：

$link=mssql_connect($server, 'username','password');
if (!$link) {
die('Something went wrong while connecting to the mssql database, it could be offline! ' . mssql_get_last_message());
                                        }
                                        mssql_select_db('GunzDB', $link);
                                        $result="SELECT * FROM Account WHERE UserID = '$username'";

                                        if(mssql_num_rows($result) > 0){
                                            echo "That username is already in use!";    
                                    } else{
                                        $result="SELECT * FROM Account WHERE Email = '$email'";

                                        if(mssql_num_rows($result) > 0){
                                            echo "That email is already in use!";
                                        } else{

                                            $query="INSERT INTO Account (UserID, UGradeID, PGradeID, RegDate, Name, Email) VALUES ('" . $username . "','0','0','00:00','" . $name . "','" . $email . "')";
                                            if($query){
                                            $result="SELECT * FROM Account WHERE UserID = '$username'";

                                            $row = mssql_fetch_array($result);
                                            $AID=$row['AID'];
                                            $query="INSERT INTO Login (AID, Password) VALUES ('" . $AID . "','" . $password . "')";
                                            if($query){
                                            echo "<span style='color: lime'>Your account has been successfully created!</span>";
                                            } else{
                                                echo "error with MSSQL: " . mssql_get_last_message();
                                            }
                                            } else{
                                             echo "error with MSSQL: " . mssql_get_last_message();  
                                            }

我不断收到这些错误警告：mssql_num_rows() 期望参数 1 是资源，第 81 行 /var/www/gunz/register.php 中给出的字符串

警告：mssql_num_rows() 期望参数 1 是资源，字符串在第 86 行的 /var/www/gunz/register.php 中给出

警告：mssql_fetch_array() 期望参数 1 是资源，在第 94 行的 /var/www/gunz/register.php 中给出的字符串

它与这些行有关

$result="SELECT * FROM Account WHERE UserID = '$username'";

$result="SELECT * FROM Account WHERE Email = '$email'";

$result="SELECT * FROM Account WHERE UserID = '$username'";

我能得到一些帮助吗？

4

1 回答 1

0

您不是为了获得结果而发送查询。

$result = mssql_query("SELECT ... ");

您也容易受到 SQL 注入的攻击。阅读使用绑定参数和准备好的语句。

见手册

于 2013-04-08T17:50:03.450 回答