Question

我正在尝试获取用户信息，即使他们没有登录只是为了在登录页面上显示图像和名称，如果他们使用自己的个人资料链接访问我的网站。

之前和之前我正在使用这种方法

add_action('validate_password_reset','wdm_validate_password_reset',10,2);

function wdm_validate_password_reset( $errors, $user)
{
    $exp = '/^(?=.*\d)((?=.*[a-z])|(?=.*[A-Z])).{6,32}$/';

    if(strlen($_POST['pass1'])<6 || !preg_match($exp, $_POST['pass1']) )
           $errors->add( 'error',  'Password must be alphanumeric and contain minimum 6 characters.','');
}

所以现在我正在尝试进行少量更改并在登录页面上显示名称，如果他们通过自己的链接访问//file to connect db require_once 'incdb/db.inc.con.php'; //check to see if they're logged in else head them to login page if(!isset($_SESSION['logged_in'])) { header("Location: login.php"); } // checking user $userID = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $_GET['userID']); $Check = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM users WHERE id='$userID'"); while ($row = mysqli_fetch_assoc($Check)) { $pid = $row['id']; $pfname = $row['firstname']; $plname = $row['lastname']; }，我将添加名称和图片http://www.example.com/member.php?userID=1，这样我的代码就会显示喜欢

meta properties

这就是我所说的meta

//file to connect db 
require_once 'incdb/db.inc.con.php';

// checking user
$userID = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $_GET['userID']);
$Check = mysqli_query($GLOBALS["___mysqli_ston"], "SELECT * FROM users WHERE id='$userID'");
while ($row = mysqli_fetch_assoc($Check)) {
    $pid = $row['id'];
    $pfname = $row['firstname'];
    $plname = $row['lastname'];
}

//check to see if they're logged in else head them to login page
if(!isset($_SESSION['logged_in'])) {
    header("Location: login.php");
}

Answer 1

对我来说很好看我确信您使用了https://github.com/philip/MySQLConverterTool这有助于使代码更加安全，但如果您使用自己的MySQLi代码则更好

我想确保我识别ID的方式是安全的

1 个答案: