Question

我创建检查用户登录的php文件。如果用户和密码正确，用户可以访问目录页面。但是会话存在一些问题。重新打开浏览器后，它仍然显示隐藏的数据。我知道当我关闭浏览器时会话将被关闭，但这种情况看起来很奇怪。这是登录表单：

<html>
    <body>
    <?php

    $LabelLogin=array("login"=>"login",
                        "password"=>"password",
                        );
    echo "<h1> Login and Register Page </h1>";
    echo "<form action='CheckLoginDetail.php' method=POST>";
                    foreach($LabelLogin as $keys =>$values)
                    {
                        if($keys=='password')
                        {
                            echo "$values <input type='password' name='$keys' /><br/>";
                        }
                        else
                        {
                            echo "$values <input type='text' name='$keys' /><br/>";
                        }
                    }
                    echo "<input type='submit'  value='submit' />";
    echo "<br/>click <a href='register.php'>here<a/> to register if you don't have an accout <br/>";                
    echo "</form>";
    ?>
    </body>

2nd CheckLoginDetail.php

<?php
session_start();
include("connect.inc");
$connect=mysqli_connect($host,$username,$password,$dbname) or die ("can't connect to server");
$labels=array("login"=>"login",
                "password"=>"password");

foreach($_POST as $keys =>$values)
{
    if(empty($values))
    {
        $empty_values[]=$keys;
    }
    elseif(!preg_match("/^[A-Za-z0-9_]+$/",$values))
    {
        $invalid_values[]=$keys;
    }
    else
    {
        $data[$keys]=$values;
    }
}
if(@sizeof($empty_values)>0 or @sizeof($invalid_values)>0)
{
    if(@sizeof($empty_values)>0)
    {
        echo "login name or password or both can not be empty !";
    }
    if(@sizeof($invalid_values)>0)
    {
        echo "values contain invalid characters";
    }
    include("FrontPage.php");
    exit();
}
else
{
    foreach($data as $keys =>$values)
    {
        $clean_data[$keys]=mysqli_real_escape_string($connect,strip_tags(trim($values)));
    }

    $query="SELECT LoginName and Password FROM yugimemberinfo WHERE LoginName='";
    foreach($clean_data as $keys =>$values)
    {
        if($keys=="login")
        {
            $query.="$values'";
        }
        if($keys=="password")
        {
            $values=md5($values);
            $query.=" AND Password='$values'";
        }
    }



    $result=mysqli_query($connect,$query) or die("can't execute query ".mysqli_error($connect));

    if(mysqli_num_rows($result)==0)
    {
        echo "login fail";
        include("FrontPage.php");
        exit();
    }
    else
    {
        $_SESSION['access']="yes";
        echo "login succesfully !<br/>";
        echo "Here are two options for you :<br/>";
        echo "<ul>
                    <li><a href='ShowCatalog.php'>Go to Card Catalog</a></li>
                    <li><a href='search_form.php'>Searching for your cards</a></li>
                </ul>";

        $query_insert="INSERT INTO yugimember (LoginName,LoginTime) VALUES(";
        foreach($clean_data as $keys =>$values)
        {
        //echo "$keys =>$values<br/>";
            if($keys=="login")
            {
                $query_insert.="'$values',";
            }
        }
        //insert login name and time to yugimember
        $query_insert.="'".date("Y-m-d H:i:s")."')";
        $result=mysqli_query($connect,$query_insert) or die ("can't execute query line 62");
    }
}
?>

如果用户成功登录，他们可以舔到将他们带到另一个名为“ShowCatalog.php”的网站的链接

<?php
session_start();
include("connect.inc");
$connect=mysqli_connect($host,$username,$password,$dbname) or die ("can't connect to server");
if(@$_SESSION['access'] != 'yes')
{
    include("FrontPage.php");
    exit();
}
$query="SELECT * FROM dragon ";
$result=mysqli_query($connect,$query) or die("can't execute query");

echo "<hr/>";

while($row=mysqli_fetch_assoc($result))
{
    extract($row);
    echo $type."<br/>";
    echo $CardName."<br/>";
    echo $atk." \ ".$def."<br/>";
    echo $Description;
    echo "<br/>".$picture."<br/>";
    echo "<br/>";
    echo "<a href='../dragon/{$picture}'><img src='../dragon/{$picture}'  height='300' width='300'></a>";
    echo "<hr/>";


}


?>

我使ShowCatalog.php只显示用户登录的数据。但是当我登录并关闭浏览器然后重新打开ShowCatalog.php时，数据会静止显示。

Answer 1

不确定但是当你这样做时：

if(@$_SESSION['access'] != 'yes')

如果会话不存在（因为您关闭了浏览器），可能会绕过这种情况。

尝试：

if (!isset($_SESSION['access']) | $_SESSION['access'] != 'yes')

关闭标签后，SESSION仍然有效

1 个答案: