Question

我试图允许我网站的登录用户更改密码，然后在我的数据库中更新密码。当我点击提交按钮时，我会收到“未知栏目”[用户名]＆＃39;在＆＃39; where子句＆＃39;。我尝试了很多东西，但似乎无法让它发挥作用。我是PHP的初学者，所以不具备广泛的技能，所以我不确定问题是什么。如果有人能帮助我，我会很感激，谢谢。

<?php
session_start();


require_once ("db_connect.php");
require_once($_SERVER['DOCUMENT_ROOT'] . '/functions/functions.php');


$oldpw = ($_POST['oldpw']);
$newpw = ($_POST['newpw']);
$conpw = ($_POST['conpw']);
$currentpw = $_SESSION['password'];

if ($_POST['change'] == 'Change') {
    if ($oldpw && $newpw && $conpw) {
        if ($newpw == $conpw) {
            if ($db_server){
                mysqli_select_db($db_server, $db_database);
                $oldpw = salt($currentpw);
                // check whether username exists 
                $query = "SELECT password FROM users WHERE 'username'= '" . $_SESSION['username'] . "'";
                $result = mysqli_query($db_server, $query);
                if(!$result){
                    $message = "<p class='message'>Error: Coud not connect to the database.</p>" ;
                }else{
                    $newpw = salt($newpw);
                    $query = "UPDATE users SET password = '$newpw' WHERE username = " . $_SESSION['username'] . "";
                    mysqli_query($db_server, $query) or
                            die("Insert failed. " . mysqli_error($db_server));
                    $message = "<p class='message'>Your password has been changed!</p>";
                    // Process further here 
                    mysqli_free_result($result);
                }
            }else{
                    $message = " <p class='message'>Your current password is incorrect.</p>";
            }
        }else{
            $message = "<p class='message'>Your new passwords do not match.</p>";
        }
    }else{
        $message = "<p class='message'>Please fill in all fields.</p>";
    }
}
?>

这是我使用过的HTML：

<form action='change-password.php' method='post' id="register-form">
     <?php echo $message; ?>
         <input class="password-field" type='password' name='oldpw' value='<?php echo $username; ?>' placeholder="Current Password"><br />  
         <input  class="password-field" type='password' name='newpw' placeholder="New Password"><br />
         <input class="password-field" type='password' name='conpw' placeholder="Confrim Password">
         <input class="button" type='submit' name='change' value='Change' />
 </form>

Answer 1

您遇到的最初问题是$_SESSION['username']和$newpass的SQL字符串值在SQL字符串中没有正确单引号。有关何时以及如何在SQL语句中引用的详细信息，请查看When to use single quotes, double quotes, backticks in MySQL。

在开发代码时始终打开错误报告。在脚本的顶部：

// Disable this when your code is live...
error_reporting(E_ALL);
ini_set('display_errors', 1);

因此，使用当前代码，引用字符串而不是列名称将如下所示。

$oldpw = salt($currentpw);

// check whether username exists 
$query = "SELECT password FROM users WHERE username= '" . $_SESSION['username'] . "' AND password='$oldpw'";
//----------------------------------no quotes^^^^^^^--single-quotes^^^^^^^^^^^^^^^^
// Also adds a check that $oldpass is correct!

$result = mysqli_query($db_server, $query);
if(!$result){
    // This is ambiguous. It should probably show an error related to the query, not connection
    $message = "<p class='message'>Error: Coud not connect to the database.</p>" ;
}else{
    // This should only be done if a row was returned previously
    // Test with mysqli_num_rows()
    if (mysqli_num_rows($result) > 0) {
      $newpw = salt($newpw);

      // Adds single quotes to the username here too...
      $query = "UPDATE users SET password = '$newpw' WHERE username = '" . $_SESSION['username'] . "'";
      mysqli_query($db_server, $query) or
            die("Insert failed. " . mysqli_error($db_server));
      $message = "<p class='message'>Your password has been changed!</p>";
      // Process further here 
      mysqli_free_result($result);
    }
    else {
       // Username or password was incorrect - do something about that
    }
}

这可以进一步改善using prepared statements。您的散列密码应该不受SQL注入but it is highly recommended to get into the habit of using prepared statements的影响，因为它们是直接从用户输入派生的其他情况所必需的，以提供足够的SQL注入保护。

这看起来像是：

// Prepare the select statement to check username and old password
$stmt = mysqli_prepare($db_server, "SELECT password FROM users WHERE username = ? AND passowrd = ?");
if ($stmt) {
  // Bind parameters and execute it
  $stmt->bind_param('ss', $_SESSION['username'], $oldpw);
  $stmt->execute();

  // num_rows works here too...
  if ($stmt->num_rows > 0) {
    // Ok to update...
    // Prepare another statement for UPDATE
    $stmt2 = mysqli_prepare($db_server, "UPDATE users SET password = ? WHERE username = ?");
    if ($stmt2) {
       // Bind and execute
       $stmt2->bind_param('ss', $newpass, $_SESSION['username']);
       $stmt->execute();
    }
    // Error updating
    else echo mysqli_error($db_server);
  }
}
// Error selecting
else echo mysqli_error($db_server);

允许用户更改密码

1 个答案: