Question

我想创建简单的个人资料系统。我想在个人资料页面上显示数据库中的用户数据。我不想做设置页面。我只是想显示它。

目前db中有三列，Id，用户名和密码。我正在添加名字，姓氏，关于我和我的数据库。

我想改进我当前的php页面，不想创建新页面。请告诉我如何创建简单的个人资料系统？

这是我的index.php

代码

<?php
    session_start();

    if(isset($_SESSION['user'])){
        header("location: profile.php");
        echo "Welcome ".$_SESSION['user']." !";
    }
    else{
        display_form();
    }

    function display_form(){
        ?>
        <form action="verify.php" method="POST">
            Name:<input name = "username" type = "text" />
            Pass:<input name = "password" type = "text" />
            <input name = "submit" type="submit" />
        </form>
        <?php
    }
?>

我的profile.php代码

<?php
    session_start();

    if (isset($_SESSION['user'])){
        $loggeduser = $_SESSION['user'];
        echo "Welcome ".$loggeduser." !";

        ?>
        <a href="logout.php"> Log out now! </a>
        <?php

        //Start displaying profile


    }
    else
        header("location: index.php");
?>

验证码页

<?php

    session_start();

    //Make sql connection and select databases
    $database_connect = mysql_connect('localhost','root','');
    if(!$database_connect){
        die('Could not connect to databse');
    }
    else{
        echo "Connected to database successfully!<br/>";
    }

    $db_table_connect = mysql_select_db('selftest');
    if(!$db_table_connect){
        echo "Connection to table failed";
    }
    else{
        echo "Connected successfully to table!<br/><br/>";
    }

    //Begin with user verifications
    if(isset($_POST['submit'])){
        $username = $_POST['username'];
        $userpass = $_POST['password'];

        $sql = "SELECT * FROM users WHERE username = '$username' and password = '$userpass'";
        $result = mysql_query($sql);

        $count = mysql_num_rows($result);

        if($count == 1){
            echo "Successfully logged in!";
            $_SESSION['user'] = $username;
            header("refresh:5;url=profile.php");
        }
        else{
            echo "Failed to log in!";
            header("refresh:5;url=index.php");
        }
    }

Answer 1

SO阅读This中不接受此类问题。但我会尽力帮助。

1）永远不要相信用户输入，始终清理它。您正在查询中直接输入登录信息。那是一个SQL注入。阅读prevent SQL injection

2）mysql API已被弃用，意味着它的制作很快就会停止。习惯使用mysqli的新API。差异不大90％相同。或PDO与mysqli有点相似。

3）尝试使用类进行数据库交互。这样，您就可以轻松获取查询信息并在同一页面中显示。

目前，您可以将选择查询的result变量信息放入会话中，执行以下操作：

//Code of verification page
 if($count == 1){
            echo "Successfully logged in!";
            $_SESSION['user'] = $username;

            $_SESSION['user_info'] = mysql_fetch_array($result);
            header("refresh:5;url=profile.php");
        }

//Start displaying profile
echo $_SESSION['user_info'][name];
echo $_SESSION['user_info'][aboutme];

在Simple profile系统上寻求建议

1 个答案: