Question

<?php
ob_start();
include 'connection.php';

$username = $_POST['username'];
$password = $_POST['password'];
$user_id = $_POST ['user_id'];


$query = "SELECT *  FROM Register WHERE username= '$username' AND  Password = '$password' AND user_id= '$user_id' ";

 $result = mysqli_query($connection, $query) or exit("Error in the query: $query. " .   mysqli_error());

$row = mysqli_fetch_assoc($result);



 if ($row ) {
 $_SESSION['username'] = $username;
 echo '' . $username . '';
 &&  ($row ) {
 $_SESSION['user_id'] = 1;
 header('Location: AdminPage.php');
 }


 else if ($row ) {
 $_SESSION['username'] = $username;
 echo '' . $username . '';``
 header('location:Login.php');
  && ($row ) {
 $_SESSION['user_id'] = > 1;
 header('Location: ProtectedPage.php');
  }
  else {

 $_SESSION['error'] = 'User not recognised';
   echo 'user not recognised';
  header('location:Login.php');

 }

我试图让我的php明白，如果user_id等于1然后你的管理员，但我不断收到大量的错误，我知道我很容易受到SQL注入，它不适用于实时互联网网站，这就是为什么它的弱点

Answer 1

我认为这就是你想要的：

include 'connection.php';

$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT *  FROM Register 
          WHERE username= '" . $connection->real_escape_string($username) . "' 
            AND Password = '" . $connection->real_escape_string($password) . "'";

 $result = mysqli_query($connection, $query) or exit("Error in the query: $query. " .   mysqli_error());

$row = mysqli_fetch_assoc($result);

if ($row) {
    $_SESSION['username'] = $username;
    $_SESSION['user_id'] = $row['user_id'];
    if ($row['user_id'] == 1) {
        header('Location: AdminPage.php');
    } else {
        header('Location: ProtectedPage.php');
    }
} else {
    $_SESSION['error'] = 'User not recognised';
    echo 'user not recognised';
    header('location:Login.php');
}

在AdminPage.php中，您应该检查用户是否为管理员：

if (isset($_SESSION['user_id']) && $_SESSION['user_id'] == 1)

ProtectedPage.php只需检查用户是否已登录：

if (isset($_SESSION['user_id']))

试图让php了解登录为管理员

1 个答案: