Информация не вводится в базу данных mysql с использованием PDO

Question

У меня есть страница регистрации, на которой пользователь вводит свое имя и адрес электронной почты и отправляет им электронное письмо с активацией. Это работало, но мне сказали, что мне нужно использовать pdo, чтобы сделать его более безопасным. Прямо сейчас, когда я нажимаю кнопку «Отправить», он проходит через все без ошибок, но пользователь не добавляется в базу данных. Вот мой код:

<? 
session_start(); 

include 'db.php'; 
$dbh = new PDO("mysql:host=$dbhost;dbname=$database_name", $dbusername, $dbpasswd); 


// Define post fields into simple variables 
$first_name = $_POST['first_name']; 
$last_name = $_POST['last_name']; 
$username = $_POST['username']; 
$email_address = $_POST['email_address']; 
$password = $_POST['password']; 
$confirm_password = $_POST['confirm_password']; 
$hash = password_hash($password, PASSWORD_DEFAULT); 


/* Let's strip some slashes in case the user entered 
any escaped characters. */ 

$first_name = stripslashes($first_name); 
$last_name = stripslashes($last_name); 
$username = stripslashes($username); 
$email_address = stripslashes($email_address); 



if((!$username) || (!$email_address)){ 
    echo 'You did not submit the following required information! <br />'; 
    if(!$username){ 
     echo "Username is a required field. Please enter it below.<br />"; 
    } 
    if(!$email_address){ 
     echo "Email Address is a required field. Please enter it below.<br />"; 
    } 
    include 'register.html'; // Show the form again! 
    /* End the error checking and if everything is ok, we'll move on to 
    creating the user account */ 
    exit(); //if the error checking has failed, we'll exit the script! 
} 


if ($password <> $confirm_password){ 
    echo "<br /><strong><div style=color:#FF0000;><center>Password and confirm password do not match!<BR></center></div></strong>"; 
    include 'register.html'; 
    exit(); 
} 


/* Let's do some checking and ensure that the user's email address or username 
does not exist in the database */ 

$sql_email_check = mysql_query("SELECT email_address FROM users WHERE email_address='$email_address'"); 
$sql_username_check = mysql_query("SELECT username FROM users WHERE username='$username'"); 

$email_check = mysql_num_rows($sql_email_check); 
$username_check = mysql_num_rows($sql_username_check); 

if(($email_check > 0) || ($username_check > 0)){ 
    echo "<br /><div style=color:#FF0000;><center>Please fix the following errors: </div><br /><br />"; 
    if($email_check > 0){ 
     echo "<strong><div style=color:#FF0000;><center>Your email address has already been used by another member in our database. Please submit a different Email address!</div><br />"; 
     unset($email_address); 
    } 
    if($username_check > 0){ 
     echo "<strong><div style=color:#FF0000;><center>The username you have selected has already been used by another member in our database. Please choose a different Username!</div><br />"; 
     unset($username); 
    } 
    include 'register.html'; // Show the form again! 
    exit(); // exit the script so that we do not create this account! 
} 

/* Everything has passed both error checks that we have done. 
It's time to create the account! */ 

$stmt = $dbh->prepare("insert into users set first_name=?, last_name=?, username=?, email_address=?, password=?"); 
$stmt->execute([$first_name, $lastname, $username, $email_address, $hash]); 

if(!$stmt){ 
    echo 'There has been an error creating your account. Please contact the webmaster.'; 
} else { 
    $userid = mysql_insert_id(); 
    // Let's mail the user! 

Answer 1

Чтобы получить последний вставленный ID с помощью PDO (не mysql_insert_id()) вы бы сделать это:

$userid = $dbh->lastInsertId(); 
// Let's mail the user! 

Чтобы преобразовать остальную часть ваших mysql_* запросов к PDO, вы» возможно, вы хотите сделать что-то вроде этого:

$sql_email_check = $dbh->prepare("SELECT email_address FROM users WHERE email_address = :email"); 
$sql_email_check->execute([':email' => $email_address]); 
$email_check = $sql_email_check->rowCount(); 

$sql_username_check = $dbh->prepare("SELECT username FROM users WHERE username = :username"); 
$sql_username_check->execute([':username' => $username]); 
$username_check = $sql_username_check->rowCount(); 

if (($email_check > 0) || ($username_check > 0)) { 
    // ... 
}