热门标签 | HotTags
当前位置:  开发笔记 > 编程语言 > 正文

将变量赋给mysql查询ruby-Assignvariabletomysqlqueryruby

SoImbuildingaloginsignuppageinRubySinatra,andImtryingtoaddsomelogicsothatifsom

So I'm building a login/signup page in Ruby/Sinatra, and I'm trying to add some logic so that if someone tries to sign up with an email that is in use, it will tell them so, and not allow them to sign up

所以我正在Ruby / Sinatra中构建登录/注册页面,我正在尝试添加一些逻辑,以便如果有人尝试使用正在使用的电子邮件注册,它会告诉他们,并且不允许他们注册

require 'rubygems'
require 'sinatra'
require 'mysql'

get "/" do
        erb :form
end

post "/" do

begin
        con = Mysql.new('localhost', 'tut', 'tut', 'recruited_users')
        auth = con.query('SELECT school FROM users WHERE email = "#{params[:email]}" AND password = "#{params[:password]}"')
        auth.fetch_row
        ensure
                con.close if con
        end
end

get '/signup' do
        erb :signup
end

post '/signup' do

begin
        con = Mysql.new('localhost', 'tut', 'tut', 'recruited_users')
        check_for_user = con.query("SELECT email FROM users WHERE email = '#{params[:email]}'")
        if check_for_user == ''
                "Sorry, but there is already an account for this user. The ID is '#{params[:check_for_user]}', please try again"
        else
                auth = con.query("INSERT INTO users (email, password, school) VALUES('#{params[:email]}', '#{params[:password]}', '#{params[:school]}')")
                "Succesfully created user #{params[:email]}"
        end
        ensure
                con.close if con
        end
end

The problem is that the variable check_for_user is not receiving any value, at least not one that I can work with. I need to be able to set up the if statement so that they can only create a new user if the email does not already exist in the database.

问题是变量check_for_user没有收到任何值,至少没有我可以使用的值。我需要能够设置if语句,以便只有在数据库中尚不存在电子邮件时才能创建新用户。

1 个解决方案

#1


3  

First of all, you can't use string interpolation (#{...}) inside a single quoted string, that only works with double quoted strings (or things like %Q{...} that behave like double quoted strings). Secondly, string literals in SQL should be quoted with single quotes, MySQL and SQLite let you get away with double quotes but that's a bad habit. Thirdly, we're not hacking PHP in 1999 so you shouldn't be using string interpolation to build SQL, you should use placeholders:

首先,你不能在单个带引号的字符串中使用字符串插值(#{...}),它只适用于双引号字符串(或类似于双引号字符串的%Q {...}之类的东西) 。其次,SQL中的字符串文字应该用单引号引用,MySQL和SQLite让你得到双引号,但这是一个坏习惯。第三,我们不是在1999年破解PHP,所以你不应该使用字符串插值来构建SQL,你应该使用占位符:

sth = con.query('select school from users where email = ? and password = ?')
sth.execute(params[:email], params[:password])
row = sth.fetch
if(!row)
    # Didn't find anything
else
    # The school is in row.first
end

推荐阅读
author-avatar
手机用户2502878095
这个家伙很懒,什么也没留下!
PHP1.CN | 中国最专业的PHP中文社区 | DevBox开发工具箱 | json解析格式化 |PHP资讯 | PHP教程 | 数据库技术 | 服务器技术 | 前端开发技术 | PHP框架 | 开发工具 | 在线工具
Copyright © 1998 - 2020 PHP1.CN. All Rights Reserved | 京公网安备 11010802041100号 | 京ICP备19059560号-4 | PHP1.CN 第一PHP社区 版权所有