Question

它是一个登录表单和一个class_login.php文件。我有一个令牌，以验证表单提交。它是一个随机字符串，我发送它隐藏。我上课时收到3条错误消息。表单提交无效。表单数据无效。和无效的用户名/密码。问题是无关紧要的我在第一个错误无效表单提交时遇到了问题。它就像我发送的令牌永远不会匹配会话令牌。但是，当我删除该部分时，我总是得到无效的表单数据，即使我写了正确的现有用户/密码。请在这里需要一些帮助：

<?php


class class_login 
{
    private $id;
    private $username;
    private $password;
    private $passmd5;

    private $errors;
    private $access;
    private $login;
    private $ltoken;

    public function __construct()
    {
        $this->errors = array();

        $this->login  = isset($_POST['login'])? 1:0;
        $this->access = 0;
        $this->ltoken  = $_POST['ltoken'];
        $this->id     = 0;
        $this->username = ($this->login)? $this->filter($_POST['username']) : $_SESSION['username'];
        $this->password = ($this->login)? $this->filter($_POST['password']) : '';
        $this->passmd5 = ($this->login)? md5($this->password) : $_SESSION['password'];

    }

    public function isLoggedIn()
    {
        ($this->login)? $this->verifyPost() : $this->verifySession();

        return $this->access;
    }

    public function filter($var)
    {
        return preg_replace('/[^a-zA-Z0-9]/','',$var);
    }

    public function verifyPost()
    {
        try
        {
            if(!$this->tokenValid())
                throw new Exception('Invalid Form Submission!');
            if(!$this->isDataValid())
                throw new Exception('Invalid Form Data!');
            if(!$this->verifyDatabase())
                throw new Exception('Invalid Username/Password!');

            $this->access = 1;
            $this->registerSession();
        }
        catch(Exception $e)
        {
            $this->errors[] = $e->getMessage();
        }
    }

    public function verifySession()
    {
        if($this->sessionExist() && $this->verifyDatabase())
        $this->access = 1;
    }

    public function verifyDatabase()
    {
        include('db_connect.php');

        $data = mysql_query("SELECT ID FROM users WHERE username = '($this->username)' AND password = '($this->passmd5)'");

        if (mysql_num_rows($data))
        {
            list($this->id) = @array_values(mysql_fetch_assoc($data));

            return true;
        }
        else
            return false;

       }

    public function isDataValid()
    {
        return (preg_match('/[^a-zA-Z0-9]$/',  $this->username) && preg_match('/[^a-zA-Z0-9]$/',  $this->password))? 1:0;
    }

    public function tokenValid()
    {
        return (!isset($_SESSION['ltoken']) || $this->ltoken != $_SESSION['ltoken'])? 0 : 1;
    }

    public function registerSession()
    {
        $_SESSION['ID']       = $this->id;
        $_SESSION['username'] = $this->username;
        $_SESSION['password'] = $this->passmd5;
    }

    public function sessionExist()
    {
        return (isset($_SESSION['username']) && isset($_SESSION['password']))? 1 : 0;
    }

    public function show_errors()
    {
        foreach($this->errors as $value)
            echo $value."</br>";
    }


}

?>

这是login_form.php

<?php
$check = 0;
$ltoken = $_SESSION['ltoken'] = md5(uniqid(mt_rand(), true));
if(isset($_POST['login']))
{
    $check = 1;
    include('class_login.php');

    $login = new class_login();

    if ($login->isLoggedIn())
        echo "Success!";
    else
        $login->show_errors();

}
?>


<link rel="stylesheet" href="CSS/regstyle.css" type="text/css" />
<script src="JS/jquery-1.7.2.js" type="text/javascript"></script>
  <script type="text/javascript">
      $(document).ready(function() {
          var checker = <?php echo $check; ?>;
          if(checker == 1)
          {
          $("#logform").slideDown("fast")
          }
      });
    </script>
<div id="content">
    <?php echo $ltoken; ?>
<!-- Begin Form -->
<div class="form-content">

<form class="reg-form" method="post" action="<?php $_SERVER['PHP_SELF'] ?>">

        <fieldset>
            <div class="divusername">
                <label for="username">Username:</label>
                <input type="text" id="username" name="username"  placeholder="Your Username Here" />
            </div>
            <div class="password">
                <label for="password">Password:</label>
                <input type="password" id="password" name="password" placeholder="Your Password Here" />
            </div>
            <div class="submit-button">
                <input type="hidden" name="ltoken" value="<?php echo $ltoken; ?>" />
                <input type="submit" name="login" value="Login" />
            </div>
        </fieldset>
</form>
</div>
</div>

Answer 1

我怀疑您忘记使用session_start()开始会话。请告诉我们你如何使用这门课程。（您使用它的文件。）

修改

无视上述内容。这里的问题是您在每个页面加载时将$_SESSION['ltoken']设置为新的随机值。这就是为什么贴出的值（这是一代'落后'）永远不匹配。

Answer 2

分开这段代码：

return (!isset($_SESSION['ltoken']) || $this->ltoken != $_SESSION['ltoken'])? 0 : 1;

它可能准确，也可能不准确，但它不可读，使您的调试更难。我认为它可能会让你失望，因为你正在使用if或else作为第二个条件。

if( ! isset( $_SESSION['ltoken'] ) return false; 
return ( $this->ltoken != $_SESSION['ltoken']) ? 0 : 1;

始终是相同的错误消息

2 个答案:

修改