blocks|key|2864422|text|来自php.net|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2864423|//+Use+result
//+Attempting+to+print+$result+won't+allow+access+to+information+in+the+resource
//+One+of+the+mysql+result+functions+must+be+used
//+See+also+mysql_result(),+mysql_fetch_array(),+mysql_fetch_row(),+etc.
while+($row+=+mysql_fetch_assoc($result))+{
++++echo+$row['firstname'];
++++echo+$row['lastname'];
++++echo+$row['address'];
++++echo+$row['age'];
}|code-block|syntax|javascript|2864424|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.mysql-query.php^0|2|7|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

From <a href="http://php.net/manual/en/function.mysql-query.php" rel="nofollow">php.net</a>:

<pre><code>// Use result
// Attempting to print $result won't allow access to information in the resource
// One of the mysql result functions must be used
// See also mysql_result(), mysql_fetch_array(), mysql_fetch_row(), etc.
while ($row = mysql_fetch_assoc($result)) {
 echo $row['firstname'];
 echo $row['lastname'];
 echo $row['address'];
 echo $row['age'];
}
</code></pre>

blocks|key|2864426|text|试试这个：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2864427|if+($result->num_rows+>+0)+{
++++$tmp+=+$result->fetch_assoc();
++++$return+=+$tmp['id'];
++++return+$return;
}+else+{+...|code-block|syntax|javascript|2864428|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Try this:

<pre><code>if ($result-&gt;num_rows &gt; 0) {
 $tmp = $result-&gt;fetch_assoc();
 $return = $tmp['id'];
 return $return;
} else { ...
</code></pre>

blocks|key|4762078|text|$result只包含结果行的对象。要访问数据，您需要从result中获取行。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4762079|使用mysqli库：|4762080|$result+=+$conn->query("select+id+from+user+where+username='$username'+and+password=+sha1('$password')");
$row+=+$result->fetch_object();+//+or+$row+=+$result->fetch_array();
return+$row->id;|code-block|syntax|javascript|4762081|通过使用数组的mysql库：|4762082|$result+=+$conn->query("select+id+from+user+where+username='$username'+and+password=+sha1('$password')");
$row+=+$result->fetch_assoc();
return+$row['id'];|4762083|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

$result contains only the object of resulting rows. To access the data, you need to fetch the row from result.

With the mysqli library:

<pre><code>$result = $conn-&gt;query("select id from user where username='$username' and password= sha1('$password')");
$row = $result-&gt;fetch_object(); // or $row = $result-&gt;fetch_array();
return $row-&gt;id;
</code></pre>

With the mysql library using array:

<pre><code>$result = $conn-&gt;query("select id from user where username='$username' and password= sha1('$password')");
$row = $result-&gt;fetch_assoc();
return $row['id'];
</code></pre>

blocks|key|4479747|text|if+($result->num_rows+>+0)+{+
++++$row+=+mysql_fetch_row($result);
++++return+$row['id'];
}+else+{+
++++throw+new+Exception('Could+not+retrieve+your+user+id.');+
}+|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|4479748|我会像这样重写整个函数：|unstyled|4479749|function+getUserId($username,+$password)+
{+
++++$username+=+mysql_real_escape_string($username);+
++++$password+=+mysql_real_escape_string($password);+

++++$conn+=+db_connect();+

++++$result+=+$conn->query("SELECT+id+FROM+user+
++++++++++++++++++++++++++++WHERE+username+=+'$username'+
++++++++++++++++++++++++++++++AND+password+=+sha2(CONCAT(user.salt,'$password'),512)");+
++++if+(!$result)+{+
++++++++throw+new+Exception('Could+not+retrieve+your+user+id.');+
++++}+
++++if+($result->num_rows+>+0)+{+
++++++++$row+=+mysql_fetch_row($result);
++++++++return+$row['id'];
++++}+else+{+
++++++++throw+new+Exception('Could+not+retrieve+your+user+id.');+
++++}+
}+|4479750|防止XSS的|4479751|在从数据库回显任何值之前，对其进行清理：|offset|length|style|BOLD|4479752|echo+htmlentities($row['username']);|4479753|确保对这些散列加盐，否则就不能保证的安全|4479754|请注意，您需要向用户表中添加一个名为SALT的新字段。|CODE|4479755|ALTER+TABLE+user+ADD+COLUMN+salt+INTEGER+NULL+default+NULL;|4479756|因为密码是散列的，所以您需要时间来转换它们，请使用以下代码插入新条目：|4479757|INSERT+INTO+user+(username,+salt,+password)+
++SELECT+'$username',+@salt,+SHA2(CONCAT(@salt,'$password'),512)
++FROM+DUAL+CROSS+JOIN+(SELECT+@salt:=+FLOOR(RAND()*99999999))+q;|4479758|并使用以下代码测试有效密码：|4479759|SELECT+id,+COALESCE(salt,-1)+as+salt+FROM+user+
++WHERE+username+=+'$username'+
++++AND+CASE+WHEN+salt+IS+NULL+
+++++++++++++THEN+password+=+SHA1('$password)
+++++++++++++ELSE+password+=+SHA2(CONCAT(salt,'$password'),512)+END;|4479760|当salt结果为-1时，像这样更新用户表。|4479761|+UPDATE+user+
+++CROSS+JOIN+(SELECT+@salt:=+FLOOR(RAND()*99999999))+q
+SET+salt+=+@salt,+password+=+SHA2(CONCAT(@salt,'$username'),512);+|4479762|entityMap^0|0|0|0|0|0|K|0|0|0|K|0|0|R|I|4|0|0|0|Z|0|0|0|E|0|0|0|L|0|0^^$0|@$1|2|3|4|5|6|7|1D|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|1E|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|1F|8|@]|9|@]|A|$B|C]]|$1|I|3|J|5|F|7|1G|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|1H|8|@$M|1I|N|1J|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1K|8|@]|9|@]|A|$B|C]]|$1|S|3|T|5|F|7|1L|8|@$M|1M|N|1N|O|P]]|9|@]|A|$]]|$1|U|3|V|5|F|7|1O|8|@$M|1P|N|1Q|O|P]|$M|1R|N|1S|O|W]]|9|@]|A|$]]|$1|X|3|Y|5|6|7|1T|8|@]|9|@]|A|$B|C]]|$1|Z|3|10|5|F|7|1U|8|@$M|1V|N|1W|O|P]]|9|@]|A|$]]|$1|11|3|12|5|6|7|1X|8|@]|9|@]|A|$B|C]]|$1|13|3|14|5|F|7|1Y|8|@$M|1Z|N|20|O|P]]|9|@]|A|$]]|$1|15|3|16|5|6|7|21|8|@]|9|@]|A|$B|C]]|$1|17|3|18|5|F|7|22|8|@$M|23|N|24|O|P]]|9|@]|A|$]]|$1|19|3|1A|5|6|7|25|8|@]|9|@]|A|$B|C]]|$1|1B|3|-4|5|F|7|26|8|@]|9|@]|A|$]]]|1C|$]]

<pre><code>if ($result-&gt;num_rows &gt; 0) { 
 $row = mysql_fetch_row($result);
 return $row['id'];
} else { 
 throw new Exception('Could not retrieve your user id.'); 
} 
</code></pre>

I would rewrite the whole function like so:

<pre><code>function getUserId($username, $password) 
{ 
 $username = mysql_real_escape_string($username); 
 $password = mysql_real_escape_string($password); 

 $conn = db_connect(); 

 $result = $conn-&gt;query("SELECT id FROM user 
 WHERE username = '$username' 
 AND password = sha2(CONCAT(user.salt,'$password'),512)"); 
 if (!$result) { 
 throw new Exception('Could not retrieve your user id.'); 
 } 
 if ($result-&gt;num_rows &gt; 0) { 
 $row = mysql_fetch_row($result);
 return $row['id'];
 } else { 
 throw new Exception('Could not retrieve your user id.'); 
 } 
} 
</code></pre>

To prevent XSS 
Before echoing any value from a database sanitize it:

<pre><code>echo htmlentities($row['username']);
</code></pre>

Make sure you salt those hashes, or you will not be secure 
Note that you will need to add a new field called <code>SALT</code> to your user table. 

<pre><code>ALTER TABLE user ADD COLUMN salt INTEGER NULL default NULL;
</code></pre>

Because the passwords are hashed, you will need time to translate them, use the following code to insert new entries:

<pre><code>INSERT INTO user (username, salt, password) 
 SELECT '$username', @salt, SHA2(CONCAT(@salt,'$password'),512)
 FROM DUAL CROSS JOIN (SELECT @salt:= FLOOR(RAND()*99999999)) q;
</code></pre>

And this code to test for valid passwords:

<pre><code>SELECT id, COALESCE(salt,-1) as salt FROM user 
 WHERE username = '$username' 
 AND CASE WHEN salt IS NULL 
 THEN password = SHA1('$password)
 ELSE password = SHA2(CONCAT(salt,'$password'),512) END;
</code></pre>

Update the user table like so when salt turns out be be -1.

<pre><code> UPDATE user 
 CROSS JOIN (SELECT @salt:= FLOOR(RAND()*99999999)) q
 SET salt = @salt, password = SHA2(CONCAT(@salt,'$username'),512); 
</code></pre>

blocks|key|4762141|text|我不知道您使用的是什么DB包装器，因为您还没有向我们展示db_connect()，但我敢打赌这会起作用的：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4762142|$result+=+$conn->query(...);
$result+=+$result->fetch();
return+$result['id'];|code-block|syntax|javascript|4762143|从$conn返回的值可能是表示结果资源的对象，而不是实际的行。您需要从资源中获取行，因为可能有多个行。|4762144|entityMap^0|S|C|0|0|1|5|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

I don't know what DB wrapper you are using since you haven't shown us <code>db_connect()</code>, but I bet this will work:

<pre><code>$result = $conn-&gt;query(...);
$result = $result-&gt;fetch();
return $result['id'];
</code></pre>

The value returned from <code>$conn</code> is probably an object representing a result resource, not actual rows. You need to fetch the rows from the resource as there are potentially more than one.

blocks|key|661933|text|在我看来，主要的问题是您的函数返回的是result对象，而您实际上必须只返回id字段。为此，您必须从结果对象中获取对象/数组/关联数组形式的行，并从中返回id字段。为了说明我的想法，就原生MySQL函数而言，它看起来如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|661934|$res+=+mysql_query("SELECT+id+FROM+usersTable+WHERE+username+=+'".mysql_real_escape_string($userName)+.+"'+AND+password+=+'"+.mysql_real_escape_string($password)+."'+LIMIT+1")+or+die("Cannot+select+id:+".mysql_error());
if(mysql_num_rows($res)+>+0)+{
+++$row+=+mysql_fetch_assoc($res);+//+fetch+the+retrived+row+as+associative+array,+my+personal+favorite+though+others+may+prefer+mysql_fetch_row+or+mysql_fetch_object+instead
+++return+$row['id'];+//+return+the+retrived+id+
}
else+{
+++//+your+exception+throwing+code+goes+here
}|code-block|syntax|javascript|661935|顺便说一下，不要认为加斜杠后跟mysql_real_escape_string有任何意义，因为它们基本上是用来做同样的事情的，而mysql_real_escape_string是在数据库查询中转义用户输入的首选方法。所以，我认为你应该留下mysql_real_escape_string行，去掉地址斜杠之类的东西。|661936|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

In my opinion, the main problem is that your function is returning the result object, while you actually had to return only the id field. In order to do that you had to fetch the row from the result object as object / array / associative array and return the id field from it. Just to illustrate my idea, in terms of native MySQL functions it would look something like this:

<pre><code>$res = mysql_query("SELECT id FROM usersTable WHERE username = '".mysql_real_escape_string($userName) . "' AND password = '" .mysql_real_escape_string($password) ."' LIMIT 1") or die("Cannot select id: ".mysql_error());
if(mysql_num_rows($res) &gt; 0) {
 $row = mysql_fetch_assoc($res); // fetch the retrived row as associative array, my personal favorite though others may prefer mysql_fetch_row or mysql_fetch_object instead
 return $row['id']; // return the retrived id 
}
else {
 // your exception throwing code goes here
}
</code></pre>

As a side note, do not see any sense in addslashes followed by mysql_real_escape_string since they are basically meant to do the same thing and mysql_real_escape_string is the preferred way to escape user input in database queries. So, I think you should just leave mysql_real_escape_string lines and get rid of addslashes stuff.

Simple piece of PHP code:

<pre><code>#login.php

$_SESSION['valid_user_id'] = getUserId($username, $password);


#user_auth_fns.php

function getUserId($username, $password)
{
 $username = addslashes($username);
 $username = mysql_real_escape_string($username);
 $password = addslashes($password);
 $password = mysql_real_escape_string($password);

 $conn = db_connect();

 $result = $conn-&gt;query("select id from user where username='$username' and password= sha1('$password')");
 if (!$result) {
 throw new Exception('Could not retrieve your user id.');
 }
 if ($result-&gt;num_rows &gt; 0) {
 return $result;
 } else {
 throw new Exception('Could not retrieve your user id.');
 }
}
</code></pre>

"return $result" is wrong, however I have no idea what I should put there in order to return the id from a certain user. The PHP manual didn't provide the answer either. I know this function works because replacing 

return $result by return "test" 

returns the correct value as expected.

PHP return id from select

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

一段简单的PHP代码：#login.php$_SESSION['valid_user_id'] = getUserId($username, $password);#user_auth_fns.phpfunction getUserId($username, $password){    $username = add...

问PHP从select返回id
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP从select返回idEN