Question

我想让我的网站尽可能安全，所以我需要将我拥有的所有内容转换为PDO。我已经成功完成了一些事情，但是我在登录页面遇到了障碍。

继承我的代码：

<?php
//signin.php
include 'connect.php';
include 'header.php';
session_start();

echo '<h3>Sign in</h3>';

//first, check if the user is already signed in. If that is the case, there is no need to display this page
if(isset($_SESSION['signed_in']) && $_SESSION['signed_in'] == true)
{
    echo 'You are already signed in, you can signout if you want.';
}
else
{
    if($_SERVER['REQUEST_METHOD'] != 'POST')
    {
        echo '<div class="formdivs" id = "logindiv"><form class = "homeforms" method="post" action="">
            <label>Username:<input class="forminput" id="smallinput" type="text" name="user_name" /></label>
            <label>Password:<input class="forminput" id="smallinput" type="password" name="user_pass"></label>
            <input class = "formbutton" type="submit" name = "button" value = "Sign In!"/>
         </form></div>';


    }
    else
    {

        $errors = array();

        if(!isset($_POST['user_name']))
        {
            $errors[] = 'Missing Username.';
        }

        if(!isset($_POST['user_pass']))
        {
            $errors[] = 'Missing Password.';
        }

        if(!empty($errors))
        {
            echo 'Errors';
            echo '<ul>';
            foreach($errors as $key => $value)
            {
                echo '<li>' . $value . '</li>';
            }
            echo '</ul>';
        }
        else
        {    

//THIS IS WHERE MY PDO PROBLEM BEGINS-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|


        $password = sha1($_POST['user_pass']);
        $sql= "SELECT * FROM users WHERE user_name = :username AND user_pass = :password"; 
        $stmt = $pdo->prepare($sql);
        $stmt->bindParam(':username', $_POST['user_name']); 
        $stmt->bindParam(':password', $password);
        $stmt->execute();
        $stmt->setFetchMode(PDO::FETCH_ASSOC);

            if(true)
            {
                if(true)
                {

                    $_SESSION['signed_in'] = true;


                    while($row = $stmt->fetch())
                    {
                        $_SESSION['user_id']    = $row['user_id'];
                        $_SESSION['user_name']  = $row['user_name'];
                        $_SESSION['user_level'] = $row['user_level'];
                    }
                    header('Location: /forum.php');
                    exit;
                }
            }
        }
    }
}

include 'footer.php';
?>

我的页面加载表单但是当我按下我的提交按钮时它变成空白（除了我的页眉和页脚），这告诉我我的php有错误。（显然）

我希望我的页面能够运行其错误检查（以查看两个框是否都有输入）然后按下按钮时执行。按下按钮后我想让它回显一个SQL错误（如果有的话）（在数据库关闭的情况下等）然后如果数据库中不存在用户名或密码也回显。（IE的select语句不返回任何内容。）

目前我有＆＃34; admin＆＃34;和＃34;密码＆＃34;只是硬编码，因为我不认为我的bindparams声明有效。

编辑：我还应该声明我的错误检查都不起作用。如果我尝试使用空框运行它仍然没有显示任何内容。

编辑：解决方案：当我应该使用$ DBH时，我正在使用$ pdo。我没有意识到php手册中的$ pdo变量应该是我在connect.php文件中创建的实际实例。感谢大家的帮助

Answer 1

您需要SQL字符串中的冒号

$sql= "SELECT * FROM users WHERE user_name = :username AND user_pass = :userpass"; 
$stmt = $pdo->prepare($sql);
$stmt->bindParam(':username', $_POST['user_name']); 
$stmt->bindParam(':userpass', $password);
$stmt->execute();

不需要循环，因为它是单个记录：

$stmt->setFetchMode(PDO::FETCH_ASSOC);
$row = $stmt->fetch();
//set your session
$_SESSION['user_id']    = $row['user_id'];
$_SESSION['user_name']  = $row['user_name'];
$_SESSION['user_level'] = $row['user_level'];

保持简单

 if(isset($_POST['submit']){
    //form submitted, checking errors
    $errors = array();

    if(!isset($_POST['user_name']))
    {
        $errors[] = 'Missing Username.';
    }

    if(!isset($_POST['user_pass']))
    {
        $errors[] = 'Missing Password.';
    }

    if(!empty($errors))
    {
        echo 'Errors';
        echo '<ul>';
        foreach($errors as $key => $value)
        {
            echo '<li>' . $value . '</li>';
        }
        echo '</ul>';
        exit();//error! let's exit
    }else{
      //No errors run the PDO query here
    }

}else{
   //no submission display the form
}

我需要帮助从mysql_query转换为PDO

1 个答案: