Question

我试图让用户登录。如果密码和用户名错误，我想要一个弹出窗口警告用户该错误。当他们关闭警报时，它会返回到index.php，然后返回到登录屏幕。

但是当密码/用户名错误时，最终会返回index.php，而不会先输入任何弹出消息。我的浏览器设置没有阻止任何弹出窗口。我能知道我做错了吗？

<?php
    if($login == true){
        //Do login process
        //this portion works as long as correct username and password
    }
    else{
        echo '<script language="javascript">alert("Please enter valid username and password");</script>';
        header("location:index.php");
    }
?>


//login.php

<?php
    $username = "exampleuser";
    $password = "examplepass";
    $host = "localhost";

    $dbHandle = mysql_connect($host, $username, $password) or die("Could not connect to database");

    $selected = mysql_select_db("database_name", $dbHandle);

    $myUserName = $_POST['user'];
    $myPassword = $_POST['pass'];

    if(ctype_alnum($myUserName) && ctype_alnum($myPassword)){
        $query1 = "SELECT * FROM users WHERE username='$myUserName'";

        $result1 = mysql_query($query1);
        $count1 = mysql_num_rows($result1);

        if($count1 == 1){
            $query2 = "SELECT password FROM users WHERE username='$myUserName'";
            $result2 = mysql_query($query2);

            $row = mysql_fetch_array($result2, MYSQL_ASSOC);
            $pass = $row['password'];

            if(password_verify($myPassword, $pass)){
                $seconds = 120 + time();
                setcookie(loggedIn, date("F js - g:i a"), $seconds);
                header("location:mysite.php");
            }
            else{
                echo '<script language="javascript">
                        alert("Please enter valid username and password");
                        window.location.href = "http://index.php";
                    </script>';
                die();
            }
        }
        else{
                echo '<script language="javascript">
                        alert("Please enter valid username and password");
                        window.location.href = "http://index.php";
                    </script>';
                die();
        }
    }
    else{
        echo '<script language="javascript">
                alert("Please enter valid username and password");
                window.location.href = "http://index.php";
            </script>';
        die();
    }
?>

Answer 1

如果您将标题发送到php，它会在页面进入您的状态后直接在index.php上发送。

如果您尝试此代码：

    <?php
if($login == true){
    //Do login process
    //this portion works as long as correct username and password
}
else{
    echo '<script language="javascript">
        alert("Please enter valid username and password");
        window.location.href = "http://index.php";
</script>';
die();
}

你会发现你的代码是正确的。您需要在弹出窗口关闭时跟踪事件，以通过ajax或http重定向重定向到index.php。

编辑1：

这里有一个包含pdo的完整页面。这不是完成工作的最佳方式，但它有效。正如您将在评论中看到的，您必须避免xss攻击，并且您应该更改数据库结构，保存密码哈希和盐以隐藏用户＆＃39;清除密码。

这是代码。

<?php
//login.php
//connection via PDO
try{
    $pdo = new PDO ('mysql:host=localhost; dbname=database_name', 'exampleuser' , 'examplepass', array(PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8"));
    //alert errors and warnings
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}catch(PDOException $e){
    exit('Database Error.');
}

//prepared statements sanitize input binding parameters, for you but you can use some libraries to prevent sql injection
$myUserName = trim(filter_var($_POST['user'], FILTER_SANITIZE_STRING));;
$myPassword = trim(filter_var($_POST['pass'], FILTER_SANITIZE_STRING));;

if(!empty($myUserName) && ctype_alnum($myUserName) && !empty($myPassword) && ctype_alnum($myPassword)){
    $query1 = $pdo->prepare("SELECT password FROM users WHERE username = :username_param");
    //bind parameter avoiding principal injection (pdo does not cover xss attacks, avoid it with other methods)
    $query1->bindParam("username_param", $myUserName);
    $result = $query1->fetch();
    // or you can do $result = $query1->fetchColumn(); to get directly string instead of array

    if($result['password']){
        //you should use password_verify() if you have an hash stored in database, you should not save password in database.
        //please google about best practice storing password, it's full of beautiful guides

        //bad practice but will do the work
        if($myPassword == $result){
            $seconds = 120 + time();
            setcookie('loggedIn', date("F js - g:i a"), $seconds);
            header("location:mysite.php");
        }else{
            printAlert("Password incorrect");
        }
    }else{
        printAlert("Username not valid");
    }
}
else{
    printAlert("Invalid data");

}

function printAlert($text){
    echo "<script language='javascript'>
                alert('$text');
                window.location.href = 'http://index.php';
            </script>";
    die();
}
?>

php文件中的弹出警报脚本

1 个答案: