登录会话php

时间:2012-11-28 06:22:57

标签: php mysql session login

我创建了登录会话,并且在这些行中显示错误:未识别的myusernamemypassword。我不理解为什么。

$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword'];

这是我的checklogin.php

mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

$count=mysql_num_rows($result);

if($count==1){

session_register("myusername");
session_register("mypassword"); 
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
?>

这是我的登录表单:

<form action='checklogin.php' method="post" >
Username
<input name='myusername' type="text">
Password
<input name='mypassword' type="password">

<input type="submit" name="Submit" value="Login">

</form>

1 个答案:

答案 0 :(得分:5)

检查在使用前设置$_POST['myusername']$_POST['mypassword']

if(isset($_POST['myusername']) && isset($_POST['mypassword']) && !empty(trim($_POST['myusername'])) && !empty(trim($_POST['mypassword']))) {

 }

在表单操作中看起来也是login_true.php它应该是checklogin.php

<form action='checklogin.php' method="post" >

因为您要将login_true.php中的数据发送到check_login.php而不是{{1}},因此您会收到错误:未识别的bla bla

警告:您的代码对sql injunction

完全开放

好读:

  1. Best way to prevent SQL injection?
  2. PDO Tutorial for MySQL Developers
  3. Pdo for beginners ( why ? and how ?)