Question

我正在努力使这个脚本工作如下......

用户登录后，会转到以下链接index.php？id = 1（userid）

但我在这里尝试了很多方法是以下代码

<?php 
// Include required MySQL configuration file and functions 
require_once('config.inc.php'); 
require_once('functions.inc.php'); 

// Start session 
session_start(); 
  $_SESSION['user_id']= $id;
// Check if user is already logged in 
if ($_SESSION['logged_in'] == true) { 

              // If user is already logged in, redirect to main page 
              redirect('../index.php'); 
} else { 
              // Make sure that user submitted a username/password and username only consists of alphanumeric chars 
              if ( (!isset($_POST['username'])) || (!isset($_POST['password'])) OR 
                   (!ctype_alnum($_POST['username'])) ) { 
                            redirect('../login.php'); 
              } 

              // Connect to database 
              $mysqli = @new mysqli(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE); 

              // Check connection 
              if (mysqli_connect_errno()) { 
                            printf("Unable to connect to database: %s", mysqli_connect_error()); 
                            exit(); 
              } 

              // Escape any unsafe characters before querying database 
              $username = $mysqli->real_escape_string($_POST['username']); 
              $password = $mysqli->real_escape_string($_POST['password']);

              // Construct SQL statement for query & execute 
              $sql              = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . md5($password) . "'"; 
              $result = $mysqli->query($sql); 

              // If one row is returned, username and password are valid 
              if (is_object($result) && $result->num_rows == 1) { 
                            // Set session variable for login status to true 
                            $_SESSION['logged_in'] = true; 
                            redirect('../index.php?id=' . $_SESSION['user_id']);
              } else { 
                            // If number of rows returned is not one, redirect back to login screen 
                            redirect('../login.php'); 
              } 
} 
?>

这不是一个现场项目，也不会只是我的学习曲线。

当前代码转到以下链接index.php？id =

CD001回答后的更新代码

<?php 
// Include required MySQL configuration file and functions 
require_once('config.inc.php'); 
require_once('functions.inc.php'); 

// Start session 
session_start(); 

// Check if user is already logged in 
if ($_SESSION['logged_in'] == true) { 
              // If user is already logged in, redirect to main page 
              redirect('../index.php'); 
} else { 
              // Make sure that user submitted a username/password and username only consists of alphanumeric chars 
              if ( (!isset($_POST['username'])) || (!isset($_POST['password'])) OR 
                   (!ctype_alnum($_POST['username'])) ) { 
                            redirect('../login.php'); 
              } 

              // Connect to database 
              $mysqli = @new mysqli(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE); 

              // Check connection 
              if (mysqli_connect_errno()) { 
                            printf("Unable to connect to database: %s", mysqli_connect_error()); 
                            exit(); 
              } 

              // Escape any unsafe characters before querying database 
              $username = $mysqli->real_escape_string($_POST['username']); 
              $password = $mysqli->real_escape_string($_POST['password']); 

              // Construct SQL statement for query & execute 
              $sql              = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . md5($password) . "'"; 
              $result = $mysqli->query($sql); 

              // If one row is returned, username and password are valid 
             if (is_object($result) && $result->num_rows == 1) { 
    $iUserId = null;
    $oUser = $result->fetch_object();

    //there's only 1 record but what the hey
    while($oUser = $result->fetch_object()) {
      $iUserId = (int) $oUser->id; // assuming the field in the user table is called `id`
    }

    // Set session variable for login status to true 
    if(!is_null($iUserId)) {
      $_SESSION['logged_in'] = true; 
      redirect('../index.php?id=' . $iUserId);
    }

    //error trapping


              } else { 
                            // If number of rows returned is not one, redirect back to login screen 
                            redirect('../login.php'); 
              } 
} 
?>

当我尝试登录时，它给我一个错误

第10行

\ includes \ login.inc.php

第10行是这个

if ($_SESSION['logged_in'] == true) {

Answer 1

如果没有用ECHO php函数在页面上写入文本，请尝试：

header("Location: http://www.google.ca");

您必须根据需要更换网址。

Answer 2

你有：

// If one row is returned, username and password are valid 
if (is_object($result) && $result->num_rows == 1) { 
            // Set session variable for login status to true 
            $_SESSION['logged_in'] = true; 
            redirect('../index.php?id=' . $_SESSION['user_id']);
}

但是在你定义的文件的顶部：

$_SESSION['user_id']= $id;

但是，$ id实际上并未在该时间点定义，除非它包含在文档顶部的一个必需文件中（我认为不太可能）。

您应该从数据库结果对象（$result）中检索用户ID。

类似的东西：

// If one row is returned, username and password are valid
if (is_object($result) && $result->num_rows == 1) { 
    $iUserId = null;
    $oUser = $result->fetch_object();

    //there's only 1 record but what the hey
    while($oUser = $result->fetch_object()) {
      $iUserId = (int) $oUser->id; // assuming the field in the user table is called `id`
    }

    // Set session variable for login status to true 
    if(!is_null($iUserId)) {
      $_SESSION['logged_in'] = true; 
      redirect('../index.php?id=' . $iUserId);
    }

    //error trapping
    else {
      //throw an Exception or something to trap the invalid user id
    }
}

对于mysqli_result对象，请参阅： http://www.php.net/manual/en/class.mysqli-result.php

特别是方法： http://www.php.net/manual/en/mysqli-result.fetch-assoc.php http://www.php.net/manual/en/mysqli-result.fetch-object.php

mysqli_result对象基本上包含整个结果集，你需要遍历它以获取单个记录 - 尽管你已经只有1条记录可以使用：

$result->data_seek(0);
$oUser = $result->fetch_object();
$iUserId = (int) $oUser->id; //assuming the user id field is called 'id'

顺便说一句：可以说更好的做法是让SQL查询在用户名上匹配并检索id和密码 - 然后在应用程序而不是数据库中评估密码;它进一步降低了注入攻击工作的可能性，这意味着您可以使用应用程序中的散列和salting对象更好地加密密码。

使用用户ID登录后重定向

2 个答案: