Question

我是php编程的新手。我已经写了一个注册html文件，用户输入他的电子邮件和密码。如果用户已经注册，我将重定向到登录屏幕，如果用户是新用户，我将持久保存在数据库中。现在，如果用户输入了错误的密码，他将再次被重定向到登录屏幕，但这次我想在屏幕上显示一条消息，输入的密码不正确。当用户直接导航到登录屏幕时，登录屏幕不应显示消息。

代码段如下所示：

    <?php 
      define('DB_HOST', 'hostname');
      define('DB_NAME', 'db_name'); 
      define('DB_USER','username');
      define('DB_PASSWORD','password');
      $con=mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die("Failed to connect to MySQL: " .  mysql_error()); 

      $db=mysql_select_db(DB_NAME,$con) or die("Failed to connect to MySQL: " . mysql_error());

      function NewUser() { 
        $email = $_POST['email'];
        $password = $_POST['password']; 
        $query = "INSERT INTO WebsiteUsers (email,pass) VALUES ('$email','$password')"; 

        $data = mysql_query ($query)or die(mysql_error()); 
        if($data) { 
          header('Location: reg-success.html'); 
        }
      }

      function SignUp() { 
        if(!empty($_POST['email'])){ 
          $emailQuery = mysql_query("SELECT * FROM WebsiteUsers WHERE email = '$_POST[email]'"); 
          if($row = mysql_fetch_array($emailQuery)) { 
            $query = mysql_query("SELECT * FROM WebsiteUsers WHERE email = '$_POST[email]' AND pass =  '$_POST[password]'");
           if($row = mysql_fetch_array($query)) { 
              echo 'validated user. screen that is accessible to a registered user';
           }else{
            echo 'Redirect to the sign in screen with error message';
           }
         }else{
          NewUser();
         }
        } 
      }
 if(isset($_POST['submit']))
{
    SignUp();
}
?>

请告诉我如何使用php实现此实现

Answer 1

这里有几个课程可以帮助你预防注射黑客，并让你继续学习如何做你一般想做的事情。如果为任务创建类，则可以更轻松地在其他位置重用代码。我个人喜欢PDO方法连接并从数据库中获取信息（你需要查找＆＃34;绑定＆＃34;以帮助进一步防止注入攻击），但这将有助于降低基础知识。这非常粗糙，您可能希望扩展以创建一些错误报告和更多可用功能。

<?php
    error_reporting(E_ALL);
    // Create a simple DB engine
    class DBEngine
        {
            protected   $con;
            // Create a default database element
            public  function __construct($host = '',$db = '',$user = '',$pass = '')
                {
                    try {
                            $this->con  =   new PDO("mysql:host=$host;dbname=$db",$user,$pass, array(PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING));
                        }
                    catch (Exception $e) {
                          return 0;
                        }
                }

            // Simple fetch and return method
            public  function Fetch($_sql)
                {
                    $query  =   $this->con->prepare($_sql);
                    $query->execute();

                    if($query->rowCount() > 0) {
                            $rows   =   $query->fetchAll();
                        }

                    return (isset($rows) && $rows !== 0 && !empty($rows))? $rows: 0;
                }

            // Simple write to db method
            public  function Write($_sql)
                {
                    $query  =   $this->con->prepare($_sql);
                    $query->execute();
                }
        }

    // Your user controller class
    class   UserControl
        {
            public  $_error;
            protected   $db;
            // Save the database connection object for use in this class
            public  function __construct($db)
                {
                    $this->_error   =   array();
                    $this->db       =   $db;
                }

            // Add user to DB
            protected function Add()
                {
                    $email      =   htmlentities($_POST['email'],ENT_QUOTES);
                    // Provided you have a php version that supports better encryption methods, use that
                    // but you should do at least a very basic password encryption.
                    $password   =   hash('sha512',$_POST['password']);
                    // Use our handy DBEngine writer method to write your sql
                    $this->db->Write("INSERT INTO WebsiteUsers (`email`,`pass`) VALUES ('$email','$password')");
                }

            // Fetch user from DB
            protected   function Fetch($_email = '')
                {
                    $_email     =   htmlentities($_email,ENT_QUOTES);
                    $password   =   hash('sha512',$_POST['password']);
                    // Use our handy DBEngine fetcher method to check your db
                    $_user      =   $this->db->Fetch("SELECT * FROM WebsiteUsers WHERE email = '$_email' and password = '$password'");
                    // Return true if not 0
                    return  ($_user !== 0)? 1:0;
                }

            // Simple fetch user or set user method
            public  function execute()
                {
                    // Check that email is a valid format
                    if(filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
                            // Save the true/false to error reporting
                            $this->_error['user']['in_db']  =   $this->Fetch($_POST['email']);
                            // Asign short variable
                            $_check =   $this->_error['user']['in_db'];

                            if($_check !== 1) {
                                    // Add user if not in system
                                    $this->Add();
                                    // You'll want to expand your add feature to include error reporting
                                    // This is just returning that it made it to this point
                                    $this->_error['user']['add_db'] =   1;
                                }
                            else {
                                    // Run some sort of login script
                                }
                            // Good email address
                            $this->_error['email']['validate']  =   1;
                        }
                    else
                        // Bad email address
                        $this->_error['email']['validate']  =   0;
                }
        }

//  $_POST['submit']    =   true;
//  $_POST['email']     =   'jenkybad<script>email';
//  $_POST['password']  =   'mypassword';

    if(isset($_POST['submit'])) {
        // Set up a db connection
        $db     =   new DBEngine('hostname','dbname','dbuser','dbpass');
        // Create instance of your user control
        $_user  =   new UserControl($db);
        // Execute instance
        $_user->execute();

        // Check for basic erroring
        print_r($_user->_error);
    } ?>

在php上的UI上显示服务器错误消息

1 个答案: