Question

这是我的身份验证文件我有一个带

的数据库

用户名密码电子邮件 positief（如果你有管理员权限，这里是“1”或“0”，“1”）

我希望我的代码能够识别“1”并且如果你有1“”则可以访问页面如果你不能进入它。

<html>
<body>

<?php
session_start();    // Create the session, Ready for our login data.

$username = $_POST['username']; // Gets the username from the login.php page.
$password = $_POST['password']; // Gets the plain text password.
$database = "cmict_test";

// Connect to your database
mysql_connect("","","") or die(mysql_error());
mysql_select_db("$database");

$query = "SELECT * FROM users WHERE password = '$password' LIMIT 1"; 

$username = mysql_real_escape_string($username); // just to be sure.

$result = mysql_query($query) or die(mysql_error());

while($row = mysql_fetch_array($result)){
    $resusername = $row['username']; // username from DB
    $respassword = $row['password']; // password from DB
    $resemail = $row['email']; // email from db
    $admin = $row['positief'];
}

// Are they a valid user?

if ($resusername == $username && $respassword == $password) {
    // Yes they are.
    // Lets put some data in our session vars and mark them as logged in.
    $_SESSION['loggedin'] = "1";
    $_SESSION['email'] = $resemail;
    $_SESSION['username'] = $resusername;

    header("location:navigra.php");
}else{
    // No, Lets mark them as invalid.
    $_SESSION['loggedin'] = "0";
    echo "Sorry, Invalid details.<br>";
    die ('klik <a href="testlogin.php">hier</a> om opnieuw te proberen.');
}

if ($admin == 1) {
$_SESSION['logadmin'] = "1";
} else {
$_SESSION['logadmin'] = "0"
echo "You are no admin";
die ('klik <a href = "index.html">hier</a>');
}


?>

</body>
</html>

这就是我放在页面顶部的内容检查您是否已登录以及是否拥有管理员权限

<?php
session_start(); // Start the session
$loggedin = $_SESSION['loggedin']; // Are they loggedin?
$logadmin = $_SESSION['logadmin']; // Are they admin?

// They are not logged in, Kill the page and ask them to login.
if ($loggedin != "1") {
die('Sorry you are not logged in, please click <a href="adminlogin.php">Here</a> to    
login');}

if ($logadmin != "1") {
die ('You have no POWER here');}

?>

有人可以帮我吗？我很感激。

提前谢谢！

问候，

DTcodedude

Answer 1

<html>
<body>

<?php
session_start();    // Create the session, Ready for our login data.

$username = addslashes($_POST['username']); // Gets the username from the login.php page.
$password = addslashes($_POST['password']); // Gets the plain text password.
$database = "cmict_test";

// Connect to your database
mysql_connect("","","") or die(mysql_error());
mysql_select_db("$database");

$query = "SELECT * FROM users WHERE username = '$username' and password = '$password' LIMIT 1"; 

$username = mysql_real_escape_string($username); // just to be sure.

$result = mysql_query($query) or die(mysql_error());

while($row = mysql_fetch_array($result)){
    $resusername = $row['username']; // username from DB
    $respassword = $row['password']; // password from DB
    $resemail = $row['email']; // email from db
    $admin = $row['positief'];
}

// Are they a valid user?

if ($resusername == $username && $respassword == $password) {
    // Yes they are.
    // Lets put some data in our session vars and mark them as logged in.
    $_SESSION['loggedin'] = "1";
    $_SESSION['email'] = $resemail;
    $_SESSION['username'] = $resusername;
    $_SESSION['logadmin'] = $admin;

    header("location:navigra.php");

}else{
    // No, Lets mark them as invalid.
    $_SESSION['loggedin'] = "0";
    echo "Sorry, Invalid details.<br>";
    die ('klik <a href="testlogin.php">hier</a> om opnieuw te proberen.');
}



?>

</body>
</html>

编辑：

-sded check in sql query中的用户名（由Jason建议）

-added addslashes用于防止SQL注入的基本保护。

只有管理员代码失败才能进入网页

1 个答案:

只有管​​理员代码失败才能进入网页

1 个答案:

只有管理员代码失败才能进入网页