Question

你好，你可以查看我的代码。我在这里有三个未定义的变量，我真的不知道要修复什么

注意：未定义的索引：第70行的用户名

注意：未定义的索引：第71行的密码

警告：mysql_fetch_array（）要求参数1为资源，第86行中给出布尔值

<!DOCTYPE HTML>
 <?php
    //Start session
    session_start();    
    //Unset the variables stored in session
    unset($_SESSION['SESS_Username']);
    unset($_SESSION['SESS_Password']);


?>

<html>
<head> 
<title> Ilokandroid Dynamic Web </title>

    <meta name="author" content="jessiemaymasaoay and jaysonpinzon" >
    <meta name="description" content="Student MiniSystem" >
    <meta name="keywords" content="HTML,CSS,XML,Javascript, miniSystem Web Page" />

    <style type="text/css" media="screen">

    body{background: url(assets/images/back1.png) top no-repeat fixed;}

    .upper
    {
        width:800px;height:100px; margin:auto; border: 5px; padding:2px;
    }
    #form 
    {
        width:400px;height:190px; margin:auto; border: 2px solid black; padding:10px;
        text-align: justify; margin-top: 150px;  background:#008080 ; font-size: 1p6x;
    }
    </style>


    </script>

</head>


</head>

<body>
    <div id="slide"> </div>

    <div id="form">
        <form name="loginform" action="log.php" onsubmit="return validateForm()" method="post">
        <table border="0" align="center" cellpadding="2" cellspacing="5">
              <tr>
                <td colspan="2">
                    <!--the code bellow is used to display the message of the input validation-->
                     <?php
                        if( isset($_SESSION['ERRMSG_ARR']) && is_array($_SESSION['ERRMSG_ARR']) && count($_SESSION['ERRMSG_ARR']) >0 ) 
                        {
                        echo '<ul class="err">';
                        foreach($_SESSION['ERRMSG_ARR'] as $msg) {
                            echo '<li>',$msg,'</li>'; 
                            }
                        echo '</ul>';
                        unset($_SESSION['ERRMSG_ARR']);
                        }
                    ?>
                </td>
              </tr>
              <tr>
                    <?php

// Grab User submitted information
$email = $_POST["Username"];
$pass = $_POST["password"];

// Connect to the database
$con = mysql_connect("localhost","root","");
// Make sure we connected succesfully
if(! $con)
{
    die('Connection Failed'.mysql_error());
}

// Select the database to use
mysql_select_db("ilokandroid",$con);

$result = mysql_query("SELECT Username, password FROM user WHERE Username = $email");

$row = mysql_fetch_array($result);

if($row["Username"]==$email && $row["password"]==$pass)
    echo"You are a validated user.";
else
    echo"Sorry, your credentials are not valid, Please try again.";
?>
                <td width="116"><b> Username : </b> </div></td>
                <td width="177">
                    <input type="text" name="Username" maxlength="40"/">
                </td>
              </tr>
              <tr>
                <td> <b> Password : </b> </div></td>
                <td><input name="Password" type="password" /></td>
              </tr>
              <tr>
                <td> </td> </td>
                <td width="177"><input name="remember" type="submit" value="Log In" /></td>
              </tr>
            <tr>
                <td  width="177"> Doesn't have an account? </td> <td> <a href="index.php"> Sign Up </a>  </td>
            </tr>
        </table>

        </form>
    </div>

</body>

</html>

Answer 1

您的查询失败，因为您没有在字符串值周围加上引号

$result = mysql_query("SELECT Username, password FROM user WHERE Username = $email");

应该是

$result = mysql_query("SELECT Username, password FROM user WHERE Username = '$email'");

Please, don't use mysql_* functions in new code。它们不再被维护and are officially deprecated。请参阅red box？转而了解prepared statements，并使用PDO或MySQLi - this article将帮助您确定哪个。如果您选择PDO here is a good tutorial。

您也对SQL injections

持开放态度

Answer 2

在查询中添加$ email附近的引号。

用户名=＆＃39; $ email＆＃39;

未定义的索引

2 个答案: