Question

好的我想在这里创建一个简单的登录，但我的登录代码以及intropage都无法正常工作。试图调整SESSION的代码，但没有找到运气。

这是我的login.php的代码：

<?php require_once("includes/connection.php"); ?>
<?php include("includes/header.php"); ?>


<?php

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];


    $query=mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");


    $numrows=mysql_num_rows($query);
    if($numrows!=0)
    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)
    {
    session_start();
    $_SESSION['session_username']=$username;

    /* Redirect browser */
    header("Location: intropage.php");
    }
    } else {
    $message = "Invalid username or password!";
    }

} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>


    <?php include("includes/footer.php"); ?>
    <?php if (!empty($message)) {echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";} ?>

然后这里是我的intropage.php的代码，我在其中重定向页面。

<?php 
session_start();
if(!isset($_SESSION["session_username"])){
    header("location:login.php");
} else {
?>


<?php include("includes/header.php"); ?>

    <h2>Welcome, <?php echo $_SESSION['session_username'];?>! </h2>
    <p><a href="logout.php">Logout</a> Here!</p>




<?php
}
?>

请帮忙吗？只是想做这项工作或者如果有什么你可以调整，以便我可以找到我犯了错误的地方。非常感谢！

Answer 1

您需要使用if(isset($_SESSION["session_username"]))

检查是否在所有页面中设置了会话名称

<强>的login.php

<?php

error_reporting(E_ALL); ini_set('display_errors', 1);
session_start();

?>

<?php require_once("includes/connection.php"); ?>
<?php include("includes/header.php"); ?>

<?php

if(isset($_SESSION["session_username"])){
// echo "Session is set"; // for testing purposes
header("Location: intropage.php");
}

else{
echo "You are not logged in.";
}

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];

    $query =mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");

    $numrows=mysql_num_rows($query);
    if($numrows!=0)

    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)

    {

// old placement
//    session_start();
    $_SESSION['session_username']=$username;

    /* Redirect browser */
    header("Location: intropage.php");
    }
    } else {
//    $message = "Invalid username or password!";

echo  "Invalid username or password!";
    }

} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>

<强>脚注：

您目前的代码向SQL injection开放。使用prepared statements或PDO。

mysql_*函数弃用通知：

http://www.php.net/manual/en/intro.mysql.php

从PHP 5.5.0开始，不推荐使用此扩展，不建议用于编写新代码，因为将来会删除它。相反，应使用mysqli或PDO_MySQL扩展名。在选择MySQL API时，另请参阅MySQL API Overview以获得进一步的帮助。

这些功能允许您访问MySQL数据库服务器。有关MySQL的更多信息，请访问»http://www.mysql.com/。

可以在»http://dev.mysql.com/doc/找到MySQL的文档。

<强>密码

我注意到您可能以纯文本格式存储密码。不建议这样做。

使用以下其中一项：

CRYPT_BLOWFISH
crypt()
bcrypt()
scrypt()
On OPENWALL
PBKDF2
PBKDF2 on PHP.net
PHP 5.5的password_hash()功能。
兼容性包（如果PHP <5.5）https://github.com/ircmaxell/password_compat/

其他链接：

PBKDF2 For PHP

Answer 2

<?php
session_start();

require_once("includes/connection.php");
include("includes/header.php");
$message = '';

if(isset($_REQUEST["login"])) {
    if((isset($_POST['username']) && strlen(trim($_POST['username'])) > 0) && (isset($_POST['password']) && strlen(trim($_POST['password'])) > 0)) {
        $username = filter_var($_POST['username'],FILTER_SANITIZE_STRING);
        $password = filter_var($_POST['password'],FILTER_SANITIZE_STRING);

        $query = mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."' LIMIT 1");

        if(mysql_num_rows($query) == 1) {
            $row = mysql_fetch_assoc($query));

            $_SESSION['session_username'] = $row['username'];

            /* Redirect browser */
            header("Location: intropage.php");
        } else {
            $message = "Invalid username or password!";
        }
    } else {
        $message = "All fields are required!";
    }
}
?>
<div class="container mlogin">
    <div id="login">
        <h1>LOGIN</h1>
        <form name="loginform" id="loginform" action="" method="POST">
        <p>
            <label for="user_login">Username<br />
                <input type="text" name="username" id="username" class="input" value="" size="20" />
            </label>
        </p>
        <p>
            <label for="user_pass">Password<br />
                <input type="password" name="password" id="password" class="input" value="" size="20" />
            </label>
        </p>
        <p class="submit">
            <input type="submit" name="login" class="button" value="Log In" />
        </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
        </form>
    </div>
</div>
<?php
include("includes/footer.php");
if (!empty($message)) {
echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";
}
?>

那不会这样做，session_start需要位于文件的顶部才能正常工作。因此要么将其包含在文件“includes / header.php”的开头（您在登录页面中包含），要么包含在您将在所有页面中使用的其他包含文件中。

Answer 3

将session_start()放入页面顶部。

我刚刚评论了你的代码。它为我工作。只需直接复制并运行此代码即可。

<?php session_start();
//require_once("includes/connection.php"); ?>
<?php //include("includes/header.php"); ?>


<?php

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];


   /* $query=mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");


    $numrows=mysql_num_rows($query);
    if($numrows!=0)
    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)
    {*/

    $_SESSION['session_username']=$username;
    print_r($_SESSION);

    /* Redirect browser */
   /* header("Location: intropage.php");
    }
    } else {
    $message = "Invalid username or password!";
    }
*/
} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>


    <?php include("includes/footer.php"); ?>
    <?php if (!empty($message)) {echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";} ?>

Answer 4

您无需在intropage.php中检查会话用户名你应该删除代码

 if(!isset($_SESSION["session_username"])){
header("location:login.php");

从介绍文件和启动会话只进行一次，它应该在头文件的第一行。

PHP Session无法正常工作

4 个答案: