Php - 双向登录表格[Admin＆amp;用户]

时间：2015-02-15 12:11:47

标签： php

我正在尝试创建一个能够检测用户是 admin 还是非管理员的登录表单。我试过以下但是当我运行它时我没有得到任何结果：

<?php

    session_start();
    $message = "";

    if(count($_POST)>0)
    {
        $conn = ($GLOBALS["___mysqli_ston"] = mysqli_connect("localhost", "prosoftl_rcc", "Royal"));

        ((bool)mysqli_query($conn, "USE prosoftl_rcc"));

        $result = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM student WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $row  = mysqli_fetch_array($result);

        $a = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM teacher WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $r = mysqli_fetch_array($a);

        if(is_array($row))
        {
            $_SESSION["id"] = $row[id];
            $_SESSION["name"] = $row[name];
        }
        elseif(is_array($r))
        {
            $_SESSION["admin"] = $row[id];
        }
        else
        {
            $message = "Invalid Username or Password!";
        }
    }
    if(isset($_SESSION["id"]))
    {
        header("Location:user_dashboard.php");
    }
    elseif(isset($_SESSION["admin"]))
    {
        header ("location:gui-admin.php");
    }

?>

当我为 admin 插入username和password时，会重新加载登录表单。

更新1：

非管理员部分工作正常，但 admin 部分将自身重定向/重新加载到登录表单。

5 个答案:

答案 0 :(得分：0)

你应该检查你的登录表格，应该有这样的代码：

<form name="loginform" method="post" action="check.php">

如果您的'action'vlaue无效，页面可能会刷新。

您应该确认您的登录表单已发布到您发布的php页面。

答案 1 :(得分：0)

试试这个，让我们看看会发生什么。

session_start();
$msg = "";
if(count($_POST)>0){
 $conn = ($GLOBALS["___mysqli_ston"] = mysqli_connect("localhost", "prosoftl_rcc", "Royal"));

    ((bool)mysqli_query($conn, "USE prosoftl_rcc"));

    $result = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM student WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
    $stdCount  = mysqli_num_rows($result);//counts the number or rows returned from student table
    $a = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM teacher WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
    $tchrCount = mysqli_num_rows($a);// same but with teachers table
    if($stdCount != 0){
       $row = mysql_fetch_array($result);
       $_SESSION['id'] = $row['id']; //set session for non admin.
   }else if($tchrCount != 0){
      $r = mysql_fetch_array($a);
      $_SESSION['admin'] = $r['id'];
  }else{
         echo "Username and Password is not Matching.";
  }
 }//end of the main if

我没有测试过这段代码，所以不管它是否有效，但我认为你有逻辑。

答案 2 :(得分：0)

  1. 使用引号：$ row [＆＃34; id＆＃34;]
  2. ＆＃34;地点：＆＃34;必须是资本。
  3. 调用＆＃34;标题＆＃34;功能确保你使用＆＃34;退出＆＃34;。

    4. 此代码未经过测试，但如果我理解正确，应该可以。

    <?php
    session_start();
    $message = "";
    if(count($_POST)>0)
    {
        $conn = ($GLOBALS["___mysqli_ston"] = mysqli_connect("localhost", "prosoftl_rcc", "Royal"));

        ((bool)mysqli_query($conn, "USE prosoftl_rcc"));

        $result_student = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM student WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $row_student  = mysqli_fetch_array($result_student);

        $result_teacher = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM teacher WHERE name='" . $_POST["user_name"] . "' and password = '". $_POST["password"]."'");
        $row_teacher = mysqli_fetch_array($result_teacher);

        if(is_array($result_student))
        {
            $_SESSION["id"] = $row_student["id"];
            $_SESSION["name"] = $row_student["name"];
            $_SESSION["admin"] = 0;
        }
        elseif(is_array($result_teacher))
        {
            $_SESSION["id"] = $row_teacher["id"];
            $_SESSION["name"] = $row_teacher["name"];
            $_SESSION["admin"] = $row_teacher["id"];
        }
        else
        {
            $message = "Invalid Username or Password!";
        }
    }
    if(isset($_SESSION["id"]))
    {
        if(@$_SESSION["admin"]>0)
        {  header ("Location: gui-admin.php");
           exit;
        }
        else
        {   header("Location: user_dashboard.php");
            exit;
        }
    }
?>

    希望它有所帮助......

答案 3 :(得分：0)

但我可以猜到为什么你面临的问题是你的代码只为学生工作。 在这 - 

if(is_array($row))

is_array（$ row）将始终返回true并且代码继续执行

$_SESSION["id"] = $row[id];
$_SESSION["name"] = $row[name];

但是$row[id]将为空，因为没有符合条件的行，因此不会分配$_SESSION["id"]以及何时执行此操作 - 

if(isset($_SESSION["id"]))
    {
        header("Location:user_dashboard.php");
    }
    elseif(isset($_SESSION["admin"]))
    {
        header ("location:gui-admin.php");
    }

由于没有设置任何if语句，因此不会执行任何语句。这是我的分析。这could是错误的。

尝试以下解决方案 -

您应该合并用户表，以便仅查询用户是学生还是教师。然后，您可以根据主要＆＃34;用户＆＃34;查询学生表或教师表。表。查询两个表的相同用户名和密码看起来不太好。

您可以将我的代码中的元标记更改为标题（＆＃34;位置：$ url＆＃34;）但我更喜欢这样，以便请求不会被用户缓存。 希望它有所帮助： - 

$sql="SELECT * FROM {$table} WHERE username='{$username}' and password='{$password}'"; //My variables are already filtered and safe from SQL Injection. 

$result=mysqli_query($mysqli, $sql);

if(mysqli_num_rows($result))
{
    $fetch=mysqli_fetch_row($result);
    $_SESSION["id"]=$fetch['userid'];//Just fetching all details
    $_SESSION["Name"]=$fetch['name'];//and making session variables for that.
    $_SESSION["username"]=$fetch['username'];
    $isadmin=$fetch['isadmin']; //is a BOOL value in MySQL table.

        if($isadmin) //checking whether admin or not
        {
            $_SESSION["isadmin"]=1;
            echo "<meta http-equiv='refresh' content='0;url=adminurl'>";    } //if admin redirect to different url
        else{
            $_SESSION["isadmin"]=0;
            echo "<meta http-equiv='refresh' content='0;url=userurl'>";         
        }
}
else
{
    //Username Password Incorrect
    /* Show FORM HERE */
}

答案 4 :(得分：0)

首先，您必须知道在SQL请求中直接使用POST数据真的是一个坏主意，您必须避免这种情况，并使用mysqli_real_escape_string之类的函数来清理数据。此外，您必须保护您的密码，并避免将其保存在您的数据库中，以便查看best way to store password in database。

对于您的两个SQL请求，您可以像我在此示例中一样使用mysqli_multi_query，我使用相同的脚本来获取POST数据并显示登录表单：

<?php

if(count($_POST) > 0){

    session_start();

    $link = mysqli_connect('localhost', 'user', 'pass', 'db');

    if(mysqli_connect_errno()) {
        die('db connection error : ' . mysqli_connect_error());
    }

    function secure_password($password){
        // secure your password here
        return $password;
    }

    // escape special characters
    $user_name = mysqli_real_escape_string($link, $_POST['user_name']);
    // you have to secure your passwords, when saving it of course
    $password = secure_password(mysqli_real_escape_string($link, $_POST['password']));

    $query  = "SELECT id FROM student WHERE name = '".$user_name."' and password = '".$password."';";
    $query .= "SELECT id FROM teacher WHERE name = '".$user_name."' and password = '".$password."'";

    $is_teacher = FALSE;

    if(count($_SESSION)) session_destroy();

    // you can use mysqli_multi_query for your two requests
    if (mysqli_multi_query($link, $query)) {
        do {
            if ($result = mysqli_store_result($link)) {
                if ($row = mysqli_fetch_row($result)) {
                    if($is_teacher){
                        $_SESSION['admin'] = $row[0];
                    } else {
                        $_SESSION['id'] = $row[0];
                        $_SESSION['name'] = $user_name;
                    }
                }
                mysqli_free_result($result);
            }
            if (mysqli_more_results($link)) {
                // if we have more results, so it's a teacher record
                $is_teacher = TRUE;
            }
        } while (mysqli_more_results($link) && mysqli_next_result($link));
    }
    mysqli_close($link);

    if(isset($_SESSION['id']))
    {
        header('Location:user_dashboard.php');
    }
    elseif(isset($_SESSION['admin']))
    {
        header('Location:gui-admin.php');
    }

    // no redirection, show the message and the login form
    echo 'Invalid Username or Password!';    

} 

?>
<form action='p.php' method='post'>
    User name : <input type='text' name='user_name'><br>
    Password : <input type='password' name='password'><br>
    <input type='submit' value='Submit'>
</form>

希望可以提供帮助。

相关问题
最新问题