从$ _SESSION的多个表中获取数据PHP

Question

当前我想在用户登录到系统时从两个表中获取两个不同的数据。权限表是“用户”，“user_staff”和“user_group”。但是，当用户输入其用户名和密码，并提交提示“致命错误：调用第26行的C：\ xampp \ htdocs \ auditsystem \ index.php中的非对象上的成员函数fetch_array（）”

下面是代码：

if($username!= "" && $password != "") 
{ 
//INNER JOIN user_group_module_role ON user.user_group_module_role_id = user_group_module_role.id 
    $result = $db->query("SELECT * FROM user 
          INNER JOIN user_staff ON user.user_staff_id = user_staff.id 
          WHERE username = '$username' AND password = '$password'"); 



    if($result->num_rows == 1) 
    { 
     $validate = $result->fetch_assoc(); 

     $query1 = "SELECT * FROM usergroup WHERE id = $validate[user_group_id]"; 
     $result1 = $db->query($query1); 
     $row1 = $result1->fetch_array(); 
     //change here for the authority 
     $_SESSION['user_staff'] = $validate['displayname']; 
     $_SESSION['usergroup'] = $row1['user_group_type']; 
     echo "<script language='javascript'>window.location='panel.php'</script>"; 
    } 
    else 
    { 
     echo "<script>alert('Sorry, wrong username and password please check.')</script>"; 
    } 
} 

Answer 1

您所查询的格式不正确和失败。这使得$ result1 null/false。您的查询也容易受到SQL注入的攻击！

if($username!= "" && $password != ""){ 
//INNER JOIN user_group_module_role ON user.user_group_module_role_id = user_group_module_role.id 
    $result = $db->query("SELECT * FROM user INNER JOIN user_staff ON user.user_staff_id = user_staff.id WHERE username = '$username' AND password = '$password'"); 
    if($result->num_rows == 1){ 
     $validate = $result->fetch_assoc(); 
     $query1 = "SELECT * FROM usergroup WHERE id = {$validate['user_group_id']}"; 
     if($result1 = $db->query($query1)){ 
      $row1 = $result1->fetch_array(); 
      //change here for the authority 
      $_SESSION['user_staff'] = $validate['displayname']; 
      $_SESSION['usergroup'] = $row1['user_group_type']; 
      echo "<script language='javascript'>window.location='panel.php'</script>"; 
     } else { 
      echo "<script language='javascript'>alert('SQL Error.');</script>"; 
     } 
    } else { 
     echo "<script>alert('Sorry, wrong username and password please check.')</script>"; 
    } 
}