Question

我有这段代码

$nick = $_POST["user"];
$pass = sha1($_POST["pass"]);

$user = pg_query($dbconn, "SELECT * FROM users");
$user = pg_fetch_object($user);

if($user->nick != $nick || $user->pass != $pass) {
    echo 'Wrong user or password';
}

数据库中的缺口是字符类型并且是非常散列的，但我仍然在输出中得到“错误的用户或密码”。

是否有任何类型冲突？

Answer 1

$nick = $_POST["user"];
$pass = sha1($_POST["pass"]);

$user = pg_query($dbconn, "SELECT * FROM users WHERE nick = '$nick' and pass='$pass'");
$num = pg_num_rows($user);
$user = pg_fetch_object($user);

if($num==0) {
    echo 'Wrong user or password';
}

当查询具有客户端将要交互的某些值时，请确保他不会使用某些注入方法

更改代码：

$nick = pg_escape_string(strip_tags($_POST["user"]));
$pass = sha1($_POST["pass"]);

PHP条件不起作用

1 个答案: