Question

我已经创建了一个登录活动，并且有两个edittext ID和密码。我有一个PHP代码，用他们的ID和密码检查用户。如果两者都正确则转移到另一个活动，但在这里我想要一个PHP代码，用他们的特定密码检查id。如果用户输入了正确的ID但输入的密码不正确，则应该产生错误＆＃34;请输入正确的密码＆＃34;。

请为此建议一个正确的PHP代码。

<?php

require "r_connect.php";

if($_SERVER['REQUEST_METHOD']=='POST')
{
    $rollno=$_POST['rollno'];
    $password=$_POST['password'];

    $sql = "SELECT * FROM registration_user WHERE rollno = '$rollno' AND password='$password'";

    $result = mysqli_query($connect,$sql);
    $check = mysqli_fetch_array($result);

    if(isset($check))
    {
        echo 'Success';
    }
    else
    {
        echo 'Error';
    }
}

?>

Answer 1

尝试以下代码PHP：

<?php

require "r_connect.php";

if($_SERVER['REQUEST_METHOD']=='POST')
{
    $rollno = $_POST['rollno'];
    $password = $_POST['password'];

    $sql = "SELECT password FROM registration_user WHERE rollno = '$rollno'";

    $result = mysqli_query($connect,$sql);
    $check = mysqli_fetch_array($result);

    if(mysqli_num_rows($check) > 0)
    {
        if($check["password"] == $password){
            echo 'Success';
        }else{
            echo 'pls enter correct password';
        }
    }
    else
    {
        echo 'Invalid id';
    }
}

?>

您还可以参考this教程获取更多信息

Answer 2

将您的SQL语句拆分为，首先查询WHERE rollno = '$rollno'，如果找到则继续并查询WHERE rollno = '$rollno' AND password = '$password'，如果一切正确继续，如果第一个语句失败，则找不到用户，如果第二次查询失败，则会找到用户，但密码不匹配，这是您想要的情况。

Answer 3

编写身份验证流程时，您可以牢记以下事项：

验证您的输入数据
与Select查询交互时尽可能使用预准备语句
在密码字符串上使用sha1和md5组合来存储在数据库和比较中。

我已尝试在以下代码中实现这些内容，当然总有改进的余地

function checkRollno($conn, $rollno)
{
    $stmt = mysqli_stmt_init($conn);
    $prepareQuery = "SELECT count(*) FROM tablename WHERE rollno = ?";
    //Prepared Statements
    if( mysqli_stmt_prepare($stmt, $prepareQuery ) )
    {
        // Bind params
        mysqli_stmt_bind_param($stmt, 'i', $rollno);//i is for integer
        /* execute query */
        mysqli_stmt_execute($stmt);
        /* Fetch Result */
        $result = mysqli_stmt_get_result($stmt);
        $row = mysqli_fetch_assoc($result);
        /* close statement */
        mysqli_stmt_close($stmt);
        if( count($row) < 1 )
            return false;
        else 
            return true;
    }
    else
        return false;
}
function checkUserExists($conn, $rollno, $pass)
{
    $stmt = mysqli_stmt_init($conn);
    $prepareQuery = "SELECT count(*) FROM tablename WHERE rollno = ? AND password= ?";
    //Compare sha1 of md5 of your password (You should not store or check against exact password strings)
    $pass = sha1(md5($pass));
    //Prepared Statements
    if( mysqli_stmt_prepare($stmt, $prepareQuery ) )
    {
        // Bind params
        mysqli_stmt_bind_param($stmt, 'is', $rollno, sha1(md5($pass)));// s is for strings
        /* execute query */
        mysqli_stmt_execute($stmt);
        /* Fetch Result */
        $result = mysqli_stmt_get_result($stmt);
        $row = mysqli_fetch_assoc($result);
        /* close statement */
        mysqli_stmt_close($stmt);
        if( count($row) < 1 )
            return false;
        else 
            return true;
    }
    else
        return false;
}
//Main Block
if( $_SERVER['REQUEST_METHOD'] == 'POST' )
{
    if( isset($_POST['rollno']) && $_POST['rollno'] != '' )
        $rollno = $_POST['rollno'];
    if( isset($_POST['password']) && $_POST['password'] != '' )
        $pass = $_POST['password'];

    $res = checkRollno($conn, $rollno);
    if( $res )//rollno exists
    {
        if( checkUserExists( $conn, $rollno, $pass ) )
            die('authenticated');//Authenticated
        else
            die('denied');//Wrong password

    }
    else//rollno doesn't exist
    {
        //code to reflect wrong id does not exist
    }
}

我相信你可以使用更好的功能名称:)

Prepared Statements

Answer 4

您的代码可能如下所示：

$sql = "SELECT * FROM registration_user WHERE rollno = '$rollno'";
$result = mysqli_query($connect,$sql);
$check = mysqli_fetch_array($result);

然后你可以做检查：

if(mysqli_num_rows($check) > 0)
    {
      if($check['password']===$password){
        //id and pass correct

      }else{
        // id correct , but bad password
      }
    }else
    {
        echo 'Invalid id';
    }

用于使用特定密码检查id的PHP代码

4 个答案: